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Abstract 

Traditionally, consistency is the only criterion for the quality of a theory in logic- 
based approaches to reasoning about actions. This work goes beyond that and con- 
tributes to the metatheory of actions by investigating what other properties a good 
domain description should have. We state some metatheoretical postulates concern- 
ing this sore spot. When all postulates are satisfied we call the action theory modu- 
lar. Besides being easier to understand and more elaboration tolerant in McCarthy's 
sense, modular theories have interesting properties. We point out the problems that 
arise when the postulates about modularity are violated, and propose algorithmic 
checks that can help the designer of an action theory to overcome them. 
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1 Introduction 



In logic-based approaches to knowledge representation, a given domain is de- 
scribed by a set of logical formulas T, which we call a (non-logical) theory. 
That is also the case for reasoning about actions, where we are interested in 
theories describing particular actions (or, more precisely, action types). We 
call such theories action theories. 

A priori consistency is the only criterion that formal logic provides to check 
the quality of such descriptions. In the present work we go beyond that, and 
argue that we should require more than the mere existence of a model for a 
given theory. 
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Our starting point is the fact that in reasoning about actions one usually 
distinguishes several kinds of logical formulas. Among these are effect ax- 
ioms, precondition axioms, and boolean axioms. In order to distinguish such 
non-logical axioms from logical axioms, we prefer to speak of effect laws, ex- 
ecutability laws, and static laws, respectively. Moreover we single out those 
effect laws whose effect is _L, and call them inexecutability laws. 

Given these types of laws, suppose the language is powerful enough to state 
conditional effects of actions. For example, suppose that action a is inexe- 
cutable in contexts where tfi holds, and executable in contexts where </? 2 holds. 
It follows that there can be no context where </?i A tf2 holds. Now -i(</?i A (^2) 
is a static law that does not mention a. It is natural to expect that -i(</?i A (^2) 
follows from the static laws alone. By means of examples we show that when 
this is not the case, then unexpected conclusions might follow from the theory 
T, even in the case T is logically consistent. 

This motivates postulates requiring that the different laws of an action theory 
should be arranged modularly, i.e., in separated components, and in such a way 
that interactions between them are limited and controlled. In essence, we argue 
that static laws may entail new effects of actions (that cannot be inferred from 
the effect laws alone), while effect laws and executability laws should never 
entail new static laws that do not follow from the set of static laws alone. We 
here formulate postulates that make these requirements precise. It will turn 
out that in all existing accounts that allow for these four kinds of laws [1-6], 
consistent action theories can be written that violate these postulates. In this 
work we give algorithms that allow one to check whether an action theory 
satisfies the postulates or not. With such algorithms, the task of correcting 
flawed action theories can be made easier. 

Although we here use the syntax of propositional dynamic logic (PDL) [7], 
all we shall say applies as well to hrst-order formalisms, in particular to the 
Situation Calculus [8]. All postulates we are going to present can be stated as 
well for other frameworks, in particular for action languages such as A, AH [9- 
11] and others, and for Situation Calculus based approaches. In [12] we have 
given a Situation Calculus version of our analysis, while in [13] we presented 
a similar notion for ontologies in Description Logics [14]. The present work is 
the complete version of the one hrst appeared in [15]. 

This text is organized as follows: after some background definitions (Section 2) 
we state some postulates concerning action theories (Section 3). In Sections 4 
and 5, we study the two most important of these postulates, giving algorithmic 
methods to check whether an action theory satisfies them or not. We then 
generalize our postulates (Section 6) and discuss possible strengthening of 
them (Section 7). In Section 8 we show interesting features of modular action 
theories. Before concluding, we assess related work found in the literature on 



metatheory of actions (Section 9). 



2 Preliminaries 



2.1 Dynamic logic 



Here we establish an ontology of dynamic domains. As our base formalism we 
use *-free PDL, i.e., PDL without the iteration operator *. For more details on 
PDL, see [7,16]. 

Let 2lct = {di, a,2, . . .} be the set of all atomic action constants of a given 
domain. Our running example is in terms of the Walking Turkey Scenario [4]. 
There, the atomic actions are load, shoot and tease. We use a as a variable for 
atomic actions. To each atomic action a there is an associated modal operator 
[a]. Here we suppose that the underlying multimodal logic is independently 
axiomatized (i.e., the logic is a fusion and there is no interaction between the 
modal operators [17,18]). 

*}3top = {Pi,P2, ■ ■ • } denotes the set of all propositional constants, also called 
fluents or atoms. Examples of those are loaded, alive and walking. We use p as 
a variable for propositional constants. 

We here suppose that both 2lct and *}3top are nonempty and finite. 

We use small Greek letters if, ip, . . . to denote classical formulas, also called 
boolean formulas. They are recursively defined in the following way: 

f ::= p | T | _L | —up \ipAip\ip\/ip\ip—>ip\ip-^->ip 

5m ( is the set of all classical formulas. 

Examples of classical formulas are walking —> alive and -^{bachelor A married). 

A classical formula is classically consistent if there is at least one valuation in 
classical propositional logic that makes it true. Given if G #ml, valuations(ip) 
denotes the set of all valuations of if. We note \= the logical consequence in 
classical propositional logic. 

The set of all literals is £it = *}3top U {->p : p G ^3top}. Examples of literals 
are alive and -^walking. £ will be used as a variable for literals. If £ = -ip, then 
we identify -i£ with p. 

A clause x is a disjunction of literals. We say that a literal £ appears in a 



clause x, written l G x, if £ is a disjunct of x- 

We denote complex formulas (possibly with modal operators) by capital Greek 
letters # 1; # 2 , • • • They are recursively defined in the following way: 

::= ip | [a]<P \ {a)<P \^<P\<PA<P\<P\/<P\<P^<P\<P^<P 

where <P denotes a complex formula, (a) is the dual operator of [a], defined 
by: (a)<P =a e f — >[a]— i^. Sequential composition of actions is defined by the ab- 
breviation [ai; a 2 ]<P =def [ffli][a2](P. Examples of complex formulas are loaded —> 
[shoot\-^ alive and hasGun —> (load; shoot) {-^ alive A -^loaded). 

If T is a set of formulas (modal or classical), atm(T) returns the set of all 
atoms occurring in T. For instance, atm({-i-i-ip l , [a]p 2 }) = {Pi)P 2 }- 

For parsimony's sake, whenever there is no confusion we identify a set of 
formulas with the conjunction of its elements. The semantics is that for mul- 
timodal K [19,20]. 

Definition 1 A PDL-model is a tuple M = (W, R) where W is a set of 
valuations (alias possible worlds), and R : 2lct — >• 2 Wx w a function mapping 
action constants a to accessibility relations R a C W x W. 

As an example, for 2lct = {a\, a 2 } and ^3rop = {Pi,p 2 }, we have the PDL- 
model M = (W, R), where 

W= {{Pl,P 2 },{Pl^P2},{^Pl,P2}}i 

r , . . ({Pi,P2}APi,^P2})A{PnP2}A^PnP2}), 
R{ai) = S 

({-Pi: P 2 }> {-Pi: P 2 })> ({"'Pi, P 2 }: {Pi: -P 2 }) 

#(a 2 ) = {({Pi, P 2 }, {Pi, -P 2 }), ({l>i, -P 2 }> {l>i, -P 2 })} 
Figure 1 gives a graphical representation of M . 



(^Pl,P2) 




Fig. 1. Example of a PDL-model for 2tct = {ai, a 2 }, and *Ptop = {Pi,p 2 }- 



Given j& = (W, R), a G 2lct, and w,w' G W, we write R a instead of R(a), 
and wR a w' instead of w' G R a (w). 

Definition 2 Given a PDL-model M = (W, R), the satisfaction relation is 
defined as the smallest relation satisfying: 

• 1= p (p is true at world w of model M ) if p G w; 

w 

• |= [a]<P if for every w' such that wR a w' , \= l <P; and 

• the usual truth conditions for the other connectives. 

Definition 3 A PDL-model M is a model of <P (noted \= <P) if and only if 
for all w G W, |= <P. M is a model of a set of formulas T (noted \= T ) if 

and only if \= <P for every <P G T . 

In the model depicted in Figure 1, we have |= p x —> [a 2 ]-ip 2 an d |= P\ Vp 2 - 

Definition 4 A formula <P is a consequence of the set of global axioms T in 
the class of all PDL-models (noted T \= <P) if and only if for every PDL- 
model M , if \= T , then |= <P. J 

We here suppose that the logic under consideration is compact [21]. 

Having established the formal substratum our presentation will rely on, we 
present in the next section the different types of formulas we use to describe 
dynamic domains. 



2.2 Describing action theories in PDL 



Before elaborating a theory, we need to specify what we are about to describe, 
i.e., what the formulas talk about. Following the tradition in the literature, 
we identify a domain (alias scenario) with the actions we take into account 
and the fluents they can change. More formally, we have: 

Definition 5 A domain signature is a tuple (2lct, ^3rop). 

An example of a domain is the well-known Yale Shooting Scenario (YSS) [22], 
whose signature comprises the actions load, wait and shoot, and fluents loaded 
and alive. 



1 Instead of global consequence, in [5] local consequence is considered. For that 
reason, a further modal operator □ had to be introduced, giving a logic that is 
multimodal K plus monomodal S4 for □, and where axiom schema D^ — > [a]# 
holds. 



Given a domain (2tct, ^3top), we are interested in theories whose statements 
describe the behavior of actions of 2lct on the fluents of ^3top. PDL allows 
for the representation of such statements, that we here call action laws. We 
distinguish several types of them. We call effect laws formulas relating an 
action to its effects. Statements of conditions under which an action cannot 
be executed are called inexecutability laws. Executability laws in turn stipulate 
the context where an action is guaranteed to be executable. Finally, static laws 
are formulas that do not mention actions. They express constraints that must 
hold in every possible state. These four types of laws are our fundamental 
entities and we introduce them more formally in the sequel. 



2.2.1 Static laws 

Frameworks which allow for indirect effects of actions make use of logical 
formulas that state invariant propositions about the world. Such formulas 
delimit the set of possible states. They do not refer to actions, and we suppose 
here that they are expressed as formulas of classical propositional logic. 

Definition 6 A static law is a formula tp G JnvL 

In our running example, the static law walking —> alive says that if a turkey 
is walking, then it must be alive. Another one is saved <-» (mboxl V mbox2), 
which states that an e-mail message is saved if and only if it is in mailbox 1 
or in mailbox 2 or both [23]. 

In some action languages, such as A1Z for example, we would write the state- 
ment always alive —> walking, and in the Situation Calculus it would be the 
hrst-order formula 

\/s.(Holds(walking, s) —> Holds(alive,s)). 



The set of all static laws of a given domain is denoted by S . At first glance, 
no requirement concerning consistency of S is made. Of course, we want S to 
be consistent, otherwise the whole theory is inconsistent. As we are going to 
see in the sequel, however, consistency of S alone is not enough to guarantee 
the consistency of a theory. 



2.2.2 Effect laws 

Logical frameworks for reasoning about actions contain expressions linking 
actions and their effects. We suppose that such effects might be conditional, 
and thus get a third component of such laws. 



In PDL, the formula [a]<P states that formula <P is true after every possible 
execution of action a. 

Definition 7 An effect law 2 for action a is of the form if —> [a]ip, where 
if,ip G Jml, with ip classically consistent. 

The consequent ip is the effect which obtains when action a is executed in a 
state where the antecedent if holds. An example of an effect law is loaded —> 
[shoot]-i alive, saying that whenever the gun is loaded, after shooting the turkey 
is dead. Another one is T — > [tease]walking: in every circumstance, the result 
of teasing is that the turkey starts walking. For parsimony's sake, the latter 
effect law will be written [tease]walking. 

Note that the consistency requirement for ip makes sense: if ip is inconsistent 
then we have an inexecutability law, that we consider as a separate entity and 
which we are about to introduce formally in the sequel. On the other hand, if 
if is inconsistent then the effect law is obviously superfluous. 

For the first example above, in action languages one would write the statement 

shoot causes -^alive if loaded, 

and in the Situation Calculus formalism one would write the first-order formula 

\/s.(Holds(loaded,s) —> -^Holds(alive, do(shoot,s))). 

2.2.3 Inexecutability laws 

We consider effect laws with inconsistent consequents as a particular kind 
of law which we call inexecutability laws. (Such laws are sometimes called 
qualifications [24].) This allows us to avoid mixing things that are conceptually 
different: for an action a, an effect law mainly associates it with a consequent 
ip, while an inexecutability law only associates it with an antecedent if, viz. 
the context which precludes the execution of a. 

Definition 8 An inexecutability law for action a is of the form if —> [a]_L, 
with ip G 5rnl. 

For example -^hasGun —> [shoot]A. expresses that shoot cannot be executed 
if the agent has no gun. Another example is dead —> [tease] _L: a dead turkey 
cannot be teased. 



2 Effect laws are often called action laws, but we prefer not to use that term here 
because it would also apply to executability laws that are to be introduced in the 
sequel. 



In A1Z we would write the statement impossible shoot if -^hasGun, and in the 
Situation Calculus our example would be 

\/s.(-^Holds(hasGun,s) —> -^Poss(shoot,s)). 



2.2.4 Executability laws 

With only static and effect laws one cannot guarantee that the action shoot 
can be executed whenever the agent has a gun. We need thus a way to state 
such conditions. 

In dynamic logic the dual (a)tp, defined as -i[a]-K£>, can be used to express 
executability. (a)T thus reads "execution of action a is possible". 

Definition 9 An executability law for action a is of the form tp —> (a)T , 
where tp G Jml. 

For instance hasGun —> (shoot)T says that shooting can be executed whenever 
the agent has a gun, and T — > (tease)T, also written (tease)T , establishes that 
the turkey can always be teased. 

Some approaches (most prominently Reiter's) use biconditionals ip <-» («)T, 
called precondition axioms. This is equivalent to -up <-» [«]-L, which highlights 
that they merge information about inexecutability with information about 
executability. Here we consider these entities to be different and keep them 
separate. 

In action languages such laws are not represented, they are rather implicitly 
inferred from inexecutability statements (cf. Section 7). In Situation Calculus 
our example would be stated as 

Vs.(Holds(hasGun, s) —> Poss(shoot,s)). 



Whereas all the extant approaches in the literature that allow for indirect 
effects of actions contain static and effect laws, and provide a way for rep- 
resenting inexecutabilities (in the form of implicit qualifications [25,2,4]), the 
status of executability laws is less consensual. Some authors [26,27,3,4] more 
or less tacitly consider that executability laws should not be made explicit but 
rather inferred by the reasoning mechanism. Others [2,1,5,6] have executability 
laws as hrst class objects one can reason about. 

It seems a matter of debate whether one can always do without executabilities. 
In principle it seems to be strange to just state information about necessary 
conditions for action execution (inexecutabilities) without saying anything 
about its sufficient conditions. The justification is that given an action we 



have three possible situations: it is known to be executable, known to be 
inexecutable, and unknown whether executable. This is the reason why we 
think that we need executability laws. Indeed, in several domains one wants 
to explicitly state under which conditions a given action is guaranteed to be 
executable, e.g. that a robot never gets stuck and is always able to execute 
a move action. And if we have a plan such as load; shoot (load followed by 
shoot) of which we know that it achieves the goal -i alive, then we would like 
to be sure that it is executable in the hrst place! 3 In any case, allowing for 
executability laws gives us more flexibility and expressive power. 



2.2.5 Action theories 

Given a domain (2lct, ^3top), for an action a G 2lct, we dehne £ a as the set of 
its effect laws, X a the set of its executability laws, and X a that of its inexe- 
cutability laws. 

Definition 10 An action theory for a is a tuple (S ,£ a ,X a ,X a ). 

In our running scenario example, a theory for the action shoot would be 

S = {walking — > alive}, £ s oot = {loaded^ [shoot]-* alive}, 

X shooi = {hasGun -> (shoot)T}, X shoot = {^hasGun -> [shoot]!} 

Given a dynamic domain we dehne £ = U a e2ict£ a > X = Uaesw^" 1 ) an d X = 
U a e2kt^ a - All these sets are finite, because 2lct is finite and each of the £ a , X a , 
X a is finite. 

Definition 11 An action theory is a tuple of the form (S , £ , X ,X). 

Given an action theory (S,£,X,X) and a formula <P, we write S ,£ ,X ,X |= 
<P instead ofSU^U^UT (= pDL $. 

When formalizing dynamic domains, we face the frame problem [8] and the 
ramification problem [28]. In what follows we formally present the logical 
framework in which action theories will henceforth be described. 



2.3 Dynamic logic and the frame problem 



As the reader might have already expected, the logical formalism of PDL alone 
does not solve the frame problem. For instance, if (S,£,X,X) describes our 



Of course this would require a solution to the qualification problem [24]. 



shooting domain, then 

S,£,X,T Ypn\ has Gun ^ [load]hasGun. 

The same can be said about the ramification problem in what concerns the 
derivation of indirect effects not properly caused by the action under consid- 
eration. For example, 

S,£,X,X |= -^ alive —> [tease]alive. 

Thus, given an action theory (S, £ , X,X), we need a consequence relation pow- 
erful enough to deal with the frame and ramification problems. This means 
that the deductive power of PDL has to be augmented in order to ensure that 
the only non-effects of actions that follow from the theory are those that are re- 
ally relevant. The presence of static laws makes that this is a delicate task, and 
starting with [2,3], several authors have argued that some notion of causality 
is needed. In this work we opt for the dependence-based approach presented 
in [5], which has been shown [29] to subsume Reiter's solution to the frame 
problem [30], and moreover at least partially accounts for the ramification 
problem [31]. 

In the logical framework developed in [5], metalogical information, given in 
the form of a dependence relation, is added to PDL. 

Definition 12 (Dependence relation [5]) A dependence relation is a bi- 
nary relation ~> C 21 ct x £it. 

The expression a ~~> £ denotes that the execution of action a may make the 
literal £ true. In our example we have 

(shoot, -^loaded), (shoot, -i alive), 
[shoot, -^walking), (tease, walking) 

which means that action shoot may make the literals -^loaded, -i alive and 
-^walking true, and action tease may make walking true. 

Semantically, the dependence-based approach relies on the explanation closure 
assumption [26], and its solution to the frame problem consists in a kind of 
negation as failure: because (load, -^hasGun) ^ ~>-, we have loady^ -^hasGun, 
i.e., ^hasGun is never caused by load. Thus, in a context where hasGun is 
true, after every execution of load, hasGun still remains true. We also have 
tease -/> alive and tease -/> -i alive. The meaning of all these independences is 
that the frame axioms hasGun —> [load]hasGun, -^alive —> [tea se]-^ alive and 
alive —> [tease]alive hold. 
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We assume that ~> is finite. 

A dependence relation ~~> defines a class of possible worlds models: 

Definition 13 A PDL-model M = (W, R) is a ^-model if and only if when- 
ever wR a w' then: 



• if a~U p, then Lt p implies \£ p; and 

w w' 

• if a^U -ip. then \= p implies \= p. 

w w' 

Figure 2 depicts the dependence-based condition on models. 




) c^) 



(^) 



Fig. 2. Dependence-based condition: preservation of literal —>p under hypothesis 
a-/* p. 

Given a ^-model ^#, <P and T, \= @ and |= T are dehned as in Definition 3. 

Definition 14 A formula <P is a ^-based consequence of the set of global 
axioms T in the class of all ~> -models (noted T \= <P) if and only if for every 

~~> -model M , if \= T, then |= <P. 

In our example it thus holds 

S,S,X,I |= has Gun —> [load]hasGun 

and 

S,£,X,T |= -i alive —>■ [tea se]-^ alive. 

In this way, the dependence-based approach solves the frame problem. How- 
ever, it does not entirely solve the ramification problem: while indirect effects 
such as loaded —> [shoot]^walking can be deduced with |= without explicitly 
stating that in the set of effect laws for shoot, we nevertheless still have to 
state indirect dependences such as shoots -^walking. However, according to 
Reiter's view: 

"what counts as a solution to the frame problem [. . .] is a systematic proce- 
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dure for generating, from the effect laws, [. . .] a parsimonious representation 
for [all] the frame axioms" [32]. 

We comply with that as we can dehne a semi-automatic procedure for gen- 
erating the dependence relation from the set of effect laws [33]. Moreover, as 
it has been argued in [23,31], our approach is in line with the state of the 
art because none of the existing solutions to the frame and the ramification 
problems can handle domains with both indeterminate and indirect effects. 

In the next section we turn to a metatheoretical analysis of action theories 
and make a step toward formal criteria for theory evaluation. Before that, we 
need a definition. 

Definition 15 Let (S ,£ a ,X a ,l a ) be an action theory for a, and ~> a depen- 
dence relation. Then j& = (W, R) is the big (alias maximal/standard,) model 
for (S , £ a , X a ,T a ) and ~> if and only if: 

• ^ is a ~> -model; 

• W = valuations(S) (all valuations of S); and 

• R a = {(w,w') : for all tp — > [a]ip G £ a U X a , if \= ip, then \= r ^}. 

For an example, consider an action theory whose components are given by 
S = 0, £ a = { Pl -> [abp 2 }, X a = {<a)T}, 
Z a = {Pi -> M-L}> and ~*= {( a > -'Pi), ( a > -'P2)} 
Figure 3 depicts one of its models and its associated big model. 



(puJP2) 



(^Pi,-'P^) 



(pi^Pz) 



(^Pi • ^2 ) 



Fig. 3. A model of an action theory and its big model 



(^Pl,P2 ) 



■ig ■ 



Big models contain all valuations consistent with S . Clearly, for a big model 
^ we have |= S A £ a A X a . Because j& maximizes executability, it is only 
X a which might not be true in M . 
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In the rest of the paper we characterize when an action theory with a depen- 
dence relation has a big model. 



3 The postulates 

"When does a given action theory have a model?", and, more importantly, "is 
that model intended?" are questions that naturally arise when we talk about 
action theories. Here we claim that all the approaches that are put forward in 
the literature are too liberal in the sense that we can have satishable action 
theories that are intuitively incorrect. We argue that something beyond the 
consistency notion is required in order to help us in answering these questions. 

Our central thesis is that the different types of laws defined in Section 2.2 
should be neatly separated in modules. Besides that, we want such laws to 
interfere only in one sense: static laws together with action laws for a may 
have consequences that do not follow from the action laws for a alone. The 
other way round, action laws should not allow to infer new static laws; effect 
laws should not allow to infer inexecutability laws; action laws for a should 
not allow to infer action laws for a', etc. This means that our logical modules 
should be designed in such a way that they are as specialized and as little 
dependent on others as possible. 

A first step in this direction has been the proposed division of our entities into 
the sets S , £ , X and X. In order to accomplish our goal, we have to diminish 
interaction among such modules, rendering them the least interwoven we can. 
The rest of the section contains postulates expressing this. We here only state 
the postulates, and defer explanations and discussions to Sections 4-6. 

PC (Logical consistency): S, £ a , X a , l a ^ _L 

The theory of a given action should be logically consistent. 
PS (No implicit static laws): 

if S,£ a ,X a ,l a |=^ <p, then S h CPL V 

If a classical formula can be inferred from the action theory, then it should 
be inferable from the set of static laws alone. (Note that on the left we use 
the ^-based consequence, while on the right we use consequence in classical 
logic: as both S and ip are classical, ip should be inferable from S in classical 
logic.) 
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PI (No implicit inexecutability laws): 

if S,£ a , X a ,l a ^ p-> [a]-L> then S,I a h PDL V -> M-L 

If an inexecutability law for an action a can be inferred from its action theory, 
then it should be inferable in PDL from the static laws and the inexecutability 
laws for a alone. Note that we used |= instead of |=^ because we also suppose 
that neither frame axioms nor indirect effects should be relevant to derive 
inexecutability laws. The same remark holds for the postulate that follows: 

PX (No implicit executability laws): 

if S,£ a ,X a ,l a \=^^ (fl)T, then S,X a h PDL <p -> (a)T 

If an executability law for a can be inferred from its action theory, then it 
should already "be" in X a , in the sense that it should also be inferable in PDL 
from the set of static and executability laws for a alone. 

Postulate PC is obvious, for we are interested in consistent theories. It can 
be shown that PX is a consequence of PS (see Corollary 41). 

Thus, while PC is obvious and PX can be ensured by PS, things are less 
obvious for Postulates PS and PI: it turns out that for all approaches in 
the literature they are easily violated by action theories that allow to express 
the four kinds of laws. We therefore study each of these postulates in the 
subsequent sections by means of examples, give algorithms to decide whether 
they are satisfied, and discuss about what to do in the case the answer is 'no'. 



4 No implicit static laws 



While executability laws increase expressive power, they might conflict with 
inexecutability laws. Consider, for example, the following action theory: 

[tease]walking, 
S 1 = {walking — > alive}, £ x = \ 

loaded — > [shoot]^alive 

X x = {{tease)T}, T 1 = {^alive —> [tease]±.} 
and the dependence relation: 



(shoot, ^loaded), {shoot, -^alive), i 
[shoot, -^walking) , {tease, walking) I 
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From this description we have the unintuitive inference X{ ease ' , X\ ease |= a/zwe: 
the turkey is immortal! This is an implicit static law because alive does not 
follow from S 1 alone: {S 1 ,ef ea " i ,X{ ea " i ,I? !a " i ) violates Postulate PS. 

Implicit static laws are not a drawback of our underlying logical formalism. 
They also appear in Situation Calculus-based approaches and in causal laws 
theories. To witness 4 , suppose in Lin's framework we have 

Holds(p l , s) —> Caused(p 2 , true, s) (1) 

and 

Caused(p 2 , false, s) (2) 

Then from (2) we get 

-^Holds(p 2 ,s) (3) 

and then conclude 

-^Caused(p 2 ,true,s) (4) 

Finally, from (1) and (4) we get 

-^Holds(p 1 , s) 

which is an implicit static law. 

To see how implicit static laws show up in McCain and Turner's causal laws 
approach [3], let the causal law tp =4> ip and T = j -1 ^}. Then -up is an implicit 
static law in such a description. 

How can we hnd out whether an action theory for a with a dependence relation 
~» satisfies Postulate PS? 

Theorem 16 (S , £ a , X a ,X a ) and ~> satisfy Postulate PS if and only if the 
big model for {S ,£ a , X a ,l a ) and ~» is a model of {S ,£ a , X a ,l a ) and~~>. 



PROOF. 

Let Jt = (W, R) be the big model of (S , £ a , X a , l a ) and ~>. 

(=*): As „# is a big model of {S,£ a , X a ,l a ) and ~>, we have |=^ SA£ a M a . It 
remains to show that |= X a . Let p>i —> (a)T G X a , and let w G Wbe such that 
|= (fii. Therefore, for all ifj G #m[ such that S ,£ a , X a ,l a |= ipj — > [a]_L, we 

must have ^£ <£>.,-, because 5, £ a , X a , T a \= -^(piAipj), and as (S ,£ a , X a ,l a ) 

and ~» satisfy Postulate PS, S |= ~~ , (y>i A </?.,-), and hence |= ~^(pi A </?.,■). 



The examples are from [34]. 
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Then, by the construction of M , there is some w' G W such that |= ; ip, for 
all if —> [a]ip such that S,£ a , X a \= if —> [a]ip and \= if, and wR a w'. Hence, 
1= ifi —> (ffl)T, and thus M is a model of (S ,£ a ,X a ,X a ) and ~». 

w 

(<^=): Suppose (S ,£ a ,X a ,X a ) and ~> do not satisfy Postulate PS. Then there 
must be if G ^nxt such that S , £ a , ,Y a , T a |= (/? and 5 ^ ip. This means that 
there is a valuation wa/ of S that falsifies (/?. As val G VF (because ^ contains 
all possible valuations of 5), ^# is not a model of (S , £ a , X a ,X a ) and ~». ■ 



We shall give an algorithm to hnd a hnite characterization of all 5 implicit 
static laws of a given action theory (S , £ a , Af a , T a ). The idea is as follows: for 
each executability law if — > (a)T in the theory, construct from £ a , X a and ~> 
a set of inexecutabilities {ifi —> [a]_L, . . . , ip n —> [a]_L} that potentially conflict 
with ip —> (a)T. For each i, 1 < % < n, if if A ifi is satishable w.r.t. 5, mark 
-i(<pA<fi) as an implicit static law. Incrementally repeat this procedure (adding 
all the implicit -i(ip A (/?;) to 5) until no more implicit static law is obtained. 

For an example of the execution of the algorithm, consider the action theory 
(S 1 ,£[ ease ,Xl ease ,T\ ease ) with ~~> as above. For the action tease, we have the 
executability (tease)T. Now, from £[ ease , X\ ease and ~> we try to build an 
inexecutability for tease. We take [teas e]w diking and compute then all indirect 
effects of tease w.r.t. S 1 . From walking —> alive, we get that atoe is an indirect 
effect of tease, giving us [tease] alive. But (tease, alive) ^ ~>-, which means the 
frame axiom -^ alive —> [tease] -^ alive holds. Together with [tease]alive, this gives 
us the inexecutability ^alive —> [tease] _L As S 1 U {T, -^alive} is satishable (T 
is the antecedent of the executability (tease)T), we get -^alive —> _L, i.e., the 
implicit static law alive. For this example no other inexecutability for tease 
can be derived, so the computation stops. 

Before presenting the pseudo-code of the algorithm we need some definitions. 

Definition 17 Let if G #ml and \ a clause. \ ^ s an implicate of if if and 
only if f |= pL x- 

In our running example, walking V alive and -^walking V alive are implicates of 
the set of formulas {walking —> alive, walking}. 

Definition 18 Let if G Srnt an d X a clause, x «s a prime implicate of if if 
and only if 

• X i s an implicate off, and 



5 Actually what the algorithm does is to find an interpolant of all implicit static 
laws of the theory. 
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• for every implicate \' ofip, x' h CPL X implies \ h CPL x' ■ 

The set of all prime implicates of a formula p is denoted PI(p). 

For example, the set of prime implicates of p x is just {p x }, and that of p x A 
(-iPi V p 2 ) A (-ipi V p 3 V p 4 ) is {p 1} p 2 , p 3 Vp 4 }. In our shooting domain, alive is a 
prime implicate of {walking —> alive, walking}. For more on prime implicates, 
their properties and how to compute them see [35]. 

Definition 19 Let p, ip G £mt. Then NewCons{ip, p) = PI{p Aip)\ PI{p). 

The function NewCons{ip, p) computes the new consequences of ip w.r.t. ip: 
the set of strongest clauses that follow from p A ip, but do not follow from p 
alone (cf. e.g. [36]). It is computed by subtracting the prime implicates of p 
from those of p A ip. For example, NewCons((-ip 1 Vp 2 ) A ("'Pi Vp 3 Vp 4 ), p x ) = 
{P21-P3 VpJ. And for our scenario, NewCons(walking, walking —> alive) = 
{alive, walking}. 

The algorithm below improves the one in [37] by integrating a solution to the 
frame problem (via the dependence relation ~>). For convenience, we define 
C a = £ a U T a as the set of all formulas expressing the direct consequences of 
an action a, whether they are consistent or not. 

Algorithm 1 (Finding all implicit static laws induced by a) 

input: (S,S a ,X a ,l a ) and ~> 

output: Si mp *, the set of all implicit static laws of (S , £ a , X a , T a ) 

Simp *'•= V 

C a := £ a Ul a 
repeat 

& imp ' ~ v 

for all p — > (a)T G X a do 

for all C a C C a suc/i tfia* C a ^ do 

p>c a : = /\{pi : pi -» [a]^j G C a } 

for all x £ NewCons(ip c ~ a , S) do 

if S U «S imp * U {</?, (/? c ~a, ^x} H; PL -L a«d W; G x, a i* U then 

Simp '■ = S imp U {^(p A </? c - a A ^x)} 

^imp* ' ~ ^imp* ^ ^irap 

until Simp = 

This is the key algorithm of the paper. In each step of the algorithm, S LiSi mp * 
is the updated set of static laws (the original ones fed with the implicit laws 
caught up to that point). At the end, Si mp * collects all the implicit static laws. 

Theorem 20 Algorithm 1 terminates. 
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PROOF. Let C a = £ a U X a . First, the set of candidates to be an implicit 
static law that might be due to a and that are examined in the repeat-loop 
is 

{^(ip A ific a A ->x) '■ C a QC a ,P -> («)T G X a and \ G NewCons(ip c ~ a , S)} 

As £ a , T a and A" a are finite, this set is finite. 

In each step, either the algorithm stops because Si mp = 0, or at least one of the 
candidates is put into Si mp in the outermost for-loop. (This one terminates, 
because X a , C a and NewCons(.) are finite.) Such a candidate is not going 
to be put into Si mp in future steps of the algorithm, because once added to 
S U Si m p*, h will be in the set of laws S U Si mp * of all subsequent executions 
of the outermost for-loop, falsifying its respective if-test for such a candidate. 
Hence the repeat-loop is bounded by the number of candidates, and therefore 
Algorithm 1 terminates. ■ 



While terminating, our algorithm comes with considerable computational costs: 
first, the number of formulas Lp c ~ a and tfj c ~ a is exponential in the size of C a , 
and second, the computation of NewCons(ip£ a ,S) might result in exponential 
growth. While we might expect C a to be reasonably small in practice (because 
£ a and T a are in general small), the size of NewCons(tfj c ~ a , S) is more difficult 
to control. 

Example 21 For (5 X , £[ ease , X[ ease \X[ ease ) , Algorithm 1 returns S imp * = {alive}. 

Theorem 22 Let Si mp * be the output of Algorithm 1 on input (S ,£ a ,X a ,l a ) 
and ~>. Then (S , £ a , X a ,X a ) with ~~> satisfies Postulate PS if and only if 

Simn* = V- 



PROOF. See Appendix A. ■ 

Theorem 23 Let Si mp * be the output of Algorithm 1 on input (S , £ a , X a ,X a ) 
and ~> . Then 

(1) (S U Si mp *, £ a , X a , T a ) with ~~> satisfies PS (has no implicit static law). 

(2) S ,£ a ,X a ,I a |= f\Si mp *. 



PROOF. Item (1) is straightforward from the termination of Algorithm 1 and 
Theorem 22. Item (2) follows from the fact that by the if-test in Algorithm 1, 
the only formulas that are put in Si mp * at each execution of the repeat- 
loop are exactly those that are implicit static laws of the current theory, and 
therefore of the original theory, too. ■ 



Corollary 24 For all <p G ffml, S, £ a , A" 1 ,^ ^ 99 if and only if S U 

Simp* |=^p L </?• 



PROOF. For the left-to-right direction, let S,£ a , X a , l a |= ip, for given 
(f G JmL Then 5 U S imp *,£ a , X a ,l a \= ip, by monotonicity. By Theorem 23- 
(1), (S U Si m p*, £ a , X a ,T a ) has no implicit static law, hence S U Si mp * |= tp. 

The right-to-left direction is straightforward by Theorem 23-(2). ■ 



What shall we do once we have discovered an implicit static law? 

The existence of implicit static laws may indicate too strong executability laws: 
in Example 21, we wrongly assumed that tease is always executable. Thus one 
way of 'repairing' our theory would be to consider the weaker executability 
alive —> (tease)T instead of (tease)T in X tease . 

On the other hand, implicit static laws may also indicate that the inexecutabil- 
ity laws are too strong: 

Example 25 Consider S = 0, £ shoot = {loaded -» [shoot]^ alive}, X shoot = 
{hasGun —> (shoot)T} and X shoot = {{shoot]±.}, with the dependence relation 
^= {(shoot, -1 alive), (shoot, -^walking). For this theory Algorithm 1 returns 
Simp* = {-<hasGun}. 

In Example 25 we discovered that the agent never has a gun. The problem here 
can be overcome by weakening [shoot]A. in X shoot with -^hasGun —> [s/iooi]_L. 6 

We can go further on this reasoning and also argue that the problem may 
be due to a too strong set of effect laws, or even to too strong frame ax- 
ioms (i.e., a too weak dependence relation). To witness, for Example 21, if 
we replace the law [tease]walking by the weaker alive —> [tease]walking, the 
resulting action theory would satisfy Postulate PS. In the same way, stat- 
ing the (unintuitive) dependence tease ~~> alive (which means the frame axiom 
-^alive —> [tease] -^alive is no longer valid) guarantees satisfaction of PS. (Note, 
however, that this solution becomes intuitive when alive is replaced by awake.) 

To hnish, implicit static laws of course may also indicate that the static laws 
are too weak: 



6 Regarding Examples 21 and 25, one might argue that in practice such silly errors 
will never be made. Nevertheless, the examples here given are quite simplistic, and 
for applications of real interest, whose complexity will be much higher, we simply 
cannot rely on the designer's knowledge about all side effects the stated formulas 
can have. 
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Example 26 Suppose a computer representation of the line of integers, in 
which we can be at a strictly positive number, pos, or at a negative one or 
zero, -^pos. Let maxlnt and minlnt, respectively, be the largest and the smallest 
representable integer number. Action go Left is the action of moving to the 
biggest integer strictly smaller than the one at which we are. Consider the 
following action theory for this scenario (ati means we are at number i): 

S = {ati —>■ pos : < i < maxlnt} U {ati —> ~^pos : minlnt < i < 0} 

£ = {atminint —> [goLeft]underflow} U {ati —>■ [goLeft\ati_\ : i > minlnt}, 

X = {(goLeft)T}, T = 
with the dependence relation (minlnt < i < maxlnt): 

_ \ (goLeft, ati), (goLeft, pos), 

I {goLeft, -^pos) , {goLeft, underflow) 

Applying Algorithm 1 to this action theory gives us the implicit static law 
-i(ati A ai^), i.e., we cannot be at numbers 1 and 2 at the same time. 

To summarize, in order to satisfy Postulate PS, an action theory should con- 
tain a complete set of static laws or, alternatively, should not contain too 
strong action laws. 

Remark 27 S U Si mp * in general is not intuitive. 

Whereas in the latter example the implicit static laws should be added to S , in 
the others the implicit static laws are unintuitive and due to an (in)executability 
law that is too strong and should be weakened. Of course, how intuitive the 
modified action theory will be depends mainly on the knowledge engineer's 
choice. 

To sum it up, eliminating implicit static laws may require revision of S , £ a or 
~>, or completion of X a and X a . Completing X a is the topic we address in the 
next section. 



5 No implicit inexecutability laws 



Let S 2 = S 1 , £ 2 = £\ and X 2 = T 2 = 0, and let ~> be that for {S 1 , £ 1 ,X l ,X 1 ). 
Note that {S 2 , £ 2 , X 2 ,X 2 ) and ~-> satisfy Postulate PS. From [tease]walking it 
follows with S 2 that \tease\alive, i.e., in every situation, after teasing the turkey, 
it is alive: S 2 ,£ 2 tease |= \tease\alive. Now as tease ^ alive, the status of alive 
is not modified by tease, and we have S 2 ,£ 2 tease \= -^alive —> [tease] -i alive. 
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From the above, it follows 

S 2 ,£^ ease ,Xt ase ,l2 ease h> ~^ alive ^ [tease]!, 

i.e., an inexecutability law stating that a dead turkey cannot be teased. But 

S 2 ,T\ ease Yp DL ^alive -» [tease]!, 

hence Postulate PI is violated. Here the formula -i alive —> [tease] _L is an 
example of what we call an implicit inexecutability law. 

In the literature, such laws are also known as implicit qualifications [25], and it 
has been often supposed, in a more or less tacit way, that it is a positive feature 
of frameworks to leave them implicit and provide mechanisms for inferring 
them [2,38,39]. The other way round, one might argue as well that implicit 
qualifications indicate that the domain has not been described in an adequate 
manner: the form of inexecutability laws is simpler than that of effect laws, 
and it might be reasonably expected that it is easier to exhaustively describe 
them. 7 Thus, all inexecutabilities of a given action should be explicitly stated, 
and this is what Postulate PI says. 

How can we check whether PI is violated? We can conceive an algorithm 
to find implicit inexecutability laws of a given action a. The basic idea is as 
follows: for every combination of effect laws of the form (y?i A ... A tp n ) —> 
[a](ipi A . . . /\ipn), with each tpi —> [a]ipi G £ a , if tpi A . . . A<p n is consistent w.r.t. 
to S, ipi A. . . Aip n inconsistent w.r.t. S , and S ,X a Yp D \_ (V 1 ^- ■ ■ ^Vn) — *■ M-L, 
then output (ipi A ... A <p n ) —> [a]! as an implicit inexecutability law. Our 
algorithm basically does this, and moreover takes into account dependence 
information. 

For an example of the execution of the algorithm, take (S 2 , E^^i X 2 tease , l\ ease ) 
with ~» as given above. From E^ 11 ^ we get the law T — > [tease]walking, whose 
antecedent is consistent with S. As long as |= -i alive —> [tease]^ alive and 
S U {walking} |= alive, and because S ,T^ ase \/p DL (T A -> alive) —> [tease] _L, 
we caught an implicit inexecutability. As there is no other combination of 
effect laws for tease, we end the simulation here. 

Below is the pseudo-code of the algorithm for that (the reason X a is not used 
in the computation will be made clear in the sequel): 

Algorithm 2 (Finding implicit inexecutability laws for a) 
input: (S,£ a ,X a ,l a ) and ~> 



7 Note that this concerns the necessary conditions for executability, and thus it is 
not related to the qualification problem, which basically says that it is difficult to 
state all the sufficient conditions for executability. 
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output: If mp , the set of implicit inexecutability laws for a 
X a : = 
for all£ a C £ a do 

(p £ 'a := NWi : (Pi -» [<#i G £ a } 

/or a/Z x £ NewCons(i(j^ a , S) do 
Theorem 28 Algorithm 2 terminates. 



PROOF. Straightforward, as we have assumed S, £ , J and ~> finite, and 
NewCons(.) is finite (because 5 and ^ f - a are finite). ■ 

Example 29 Consider S 2 , £^ ase , X\ ease ,T^ ase and ~» as given above. Then 
Algorithm 2 returns T\^ e = {^alive —> [tease]±.}. 

Nevertheless, applying Algorithm 2 is not enough to guarantee Postulate PI, 
as illustrated by the following example: 

Example 30 (Incompleteness of Algorithm 2 without PS) LetS = 0, 

£ a = {Pi -» MM; X<1 = {( a ) T l; Xa = {P2 ~> i a ]-L}; anrf ~»= 0- T/len we 

/iawe S,£ a , X a , X a \= p 1 —> [a]_L ; 6ut running Algorithm 2 on (S ,£ a ,X a ,T a ) 
we get S,l? mp Yp DL Pi -» [a]-L. 

Example 30 shows that the presence of implicit static laws (induced by ex- 
ecutabilities) implies the existence of implicit inexecutabilities that are not 
caught by Algorithm 2. Oneway of getting rid of this is requiring (S ,£ a , X a ,X a ) 
and ~» to satisfy Postulate PS prior to running Algorithm 2. This gives us 
the following result: 

Theorem 31 Let T^ mp be the output of Algorithm 2 on input {S ,£ a , X a ,l a ) 
and^>. If (S ,£ a ,X a ,T a ) with ~» satisfies Postulate PS, then it satisfies Pos- 
tulate PI if and only ifl? = 0. 



PROOF. See Appendix B. 



With Algorithm 2, not only do we decide whether Postulate PI is satisfied, 
but we also get information on how to "repair" the action theory. The set of 
implicit inexecutabilities so obtained provides logical and metalogical infor- 
mation concerning the correction that must be carried out: in the first case, 
elements of T? can be added to T a ; in the second one, T* helps in properly 
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changing £ a or ~». For instance, to correct the action theory of our example, 
the knowledge engineer would have the following options: 

(1) Add the qualification -i alive —> [tease] ! to X\ ease ; or 

(2) Add the (unintuitive) dependence {tease, alive) to ~»; or 

(3) Weaken the effect law [tease]walking to alive —> [tease]walking in E^ ase . 

It is easy to see that whatever she opts for, the resulting action theory for 
tease will satisfy Postulate PI (while still satisfying PS). 

Example 32 (Drinking coffee [12]) Suppose a situation in which we rea- 
son about the effects of drinking a cup of coffee: 

, , i sugar — > \drink\happu, ■ , . , . , 

C Ch c drink ) J L J 1 1 ^ ? I -y drink n-drink 

salt — > [drink]-^happy 

and the dependence relation 

~>-= {(drink, happy), (drink, -chappy)} 

Observe that (S, £ drmk i x dnnk , X drmk ) with ^ satisfies PS. Then, running Al- 
gorithm 2 on this action theory will give usXf™ k = {(sugarAsalt) —>■ [drink]!.}. 

Remark 33 X a U T* is not always intuitive. 

Whereas in Example 29 we have got an inexecutability that could be safely 
added to X^ ase , in Example 32 we got an inexecutability that is unintuitive 
(just the presence of sugar and salt in the coffee precludes drinking it). In 
that case, revision of other parts of the theory should be considered in order 
to make it intuitive. Anyway, the problem pointed out in the depicted scenario 
just illustrates that intuition is beyond syntax. The scope of this work relies 
on the syntactical level. Only the knowledge engineer can judge about how 
intuitive a formula is. 

In what follows we revisit our postulates in order to strengthen them to the 
case where more than one action is under concern and thus get results that 
can be applied to whole action theories. 



6 Generalizing the postulates 



We have seen the importance that satisfaction of Postulates PC, PS and PI 
may have in describing the action theory of a particular action a. However, 
in applications of real interest more than one action is involved, and thus a 
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natural question that could be raised is "can we have similar metatheoretical 
results for multiple action theories"? 

In this section we generalize our set of postulates to action theories as a 
whole, i.e., considering all actions of a domain, and prove some interesting 
results that follow from that. As we are going to see, some of these results 
are straightforward, while others must rely on some additional assumptions in 
order to hold. 

A generalization of Postulate PC is quite easy and has no need for justification: 

PC* (Logical consistency): S,£,X,1 \/= _L 
The whole action theory should be logically consistent. 
Generalizing Postulate PS will give us the following: 

PS* (No implicit static laws): 

if S,£,X,I \=^ (p, then S \= cpL <p 

If a classical formula can be inferred from the whole action theory, then it 
should be inferable from the set of static laws alone. We have the following 
results: 

Theorem 34 (S,£,X,1) and ~> satisfy PS* if and only if (S,£ a ,X a ,l a ) 
and ~> satisfies PS for all a G 2lct. 

PROOF. 

(=>): Straightforward: Suppose that for some a G 2lct (S ,£ a ,X a ,T a ) does 
not satisfy PS. Then there is (p G ^mt such that S ,£ a , X a ,l a \= ip and 
S \/k- PL <f- Of course S,£,X,1 \=^ tp, by monotonicity, but still S ^ tp. 
Hence (S ,£ ,X ,T) does not satisfy PS*. 

(-<=): Suppose (S , £ , X,X) with^> does not satisfy PS*. Then there is tp G ^nvt 
such that S , £ , X ,T \=^ ip and S ^ <p. <p is equivalent to p>\ A . . . Aip n , with 
ipi, . . . , ip n G #mi and such that there is at least one ipi such that S ^ (/?i 
(otherwise S \= <p). Because the logic is independently axiomatized, there 
must be some a G 2lct such that S , £ a , X a ,T a \=^ ipi. From this and S ^ ipi 
it follows that (5, £ a , X a ,l a ) and with '^ do not satisfy PS. ■ 

Corollary 35 (S ,£ ,X ,T) and^> satisfy Postulate PS* if and only if the big 
model for (S, £ , X , I) and ^ is a model of (S ,£ ,X ,1). 
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PROOF. The proof follows from Theorems 16 and 34. 

Theorem 36 If{S,£,X,X) with^ satisfies PS* , then (S,£,X ,X) with ~» 
satisfies PC* if and only if {S , £ a , X a ,X a ) and ~> satisfy PC for all a G 2lct. 



PROOF. Let (S,£,X,X) and ~> satisfy PS*. 

(=>): Suppose that (S ,£ a ,X a ,X a ) with ~» does not satisfy PC, for some a G 
2lct. Because (S,£,X,1) and ~> satisfy PS*, (5, £ a , X a , X a ) and ~» satisfy 
Postulate PS (Theorem 34), and then S |= _L. From this it follows that 
(S ,£ ,X ,X) does not satisfy Postulate PC*. 

(<=): Suppose (S,£, X,X) and ~» do not satisfy PC*. Then S,£, X ,1 |= _L. 
Because (S , £, X ,X) with ~» satishes Postulate PS*, 5 |= _L Since 2lct ^ 0, 
there is some a G 2lct such that S ,£ a , X a ,X a \= _L. ■ 



A more general form of Postulate PI can also be stated: 
PI* (No implicit inexecutability laws): 

if S, £, X, X \=^ ip — > [ffl]-L, then 5,1 |= (/? — > [a]_L 

If an inexecutability law can be inferred from the whole action theory, then it 
should be inferable in PDL from the static and inexecutability laws alone. 

Note that having that {S,£ a , X a ,X a ) with ~> satisfies PI for all a G 2tct is 
not enough to (S ,£ ,X ,X) with ~~> satisfy PI* if there are implicit static 
laws. To witness, let S = £ ai = 0, and X ai = {{ai)T}, X ai = {tp -» [ai]J_}. 
Let also £ a2 = X a9 - = X a2 = 0. Observe that both {S ,£ ai , X ai ,X ai ) and 
(S,£ a2 ,X a \X a *) with ~> satisfy PI, but S,£,X,I \= <p -» [a 2 ]i_ and 

Nevertheless, under PS* the result follows: 

Theorem 37 Let (S,£,X,X) with ~> satisfy PS*. (S,£,X,I) with ^ sat- 
isfies PI* i/ and on/y z/ {S ,£ a , X a ,X a ) and ~> satisfy PI /or a// a G 2lct. 

PROOF. See Appendix C. ■ 



In the next section we make a step toward an attempt of amending our mod- 
ularity criteria by investigating possible extensions of our set of postulates. 



25 



7 Can we ask for more? 



Can we augment our set of postulates to take into account other modules 
of action theories, or even other metatheoretical issues in reasoning about 
actions? That is the topic we discuss in what follows. 



1.1 Postulates about action effects 

It seems to be in line with our postulates to require action theories not to allow 
for the deduction of new effect laws: if an effect law can be inferred from an 
action theory (and no inexecutability for the same action in the same context 
can be derived), then it should be inferable from the set of static and effect 
laws alone. This means we should have: 

PE (No implicit effect laws): 

if S, £, X,X \= <p —> [a]ip and S ,£ ,X ,X \£ <p —> [a]!, 
then S,£ \= tp —> [a]ip 

But consider the following intuitively correct action theory: 

loaded^ [shoot]^ alive, 



S 3 = 0, £ 3 = 



(-^loaded A alive) —> [shoot]alive 



X 3 = {hasGun —>■ (shoot)T}, X 3 = {-i has Gun —>■ [shoot]!.} 

together with the dependence shoot ^^ -^alive. It satisfies Postulates PS* and 
PI*, but does not satisfy PE. Indeed: 

S 3 , £ 3 , X 3 , X 3 |= -^hasGunV loaded —>■ [shoot]^alive 

and 

S 3 ,£ 3 ,X 3 ,X 3 \J= -^hasGunV loaded —>■ [shoot]!, 

but 

S 3 ,£ 3 \J= -^hasGunV loaded —>■ [shoot]^alive 

So, Postulate PE would not help us to deliver the goods. 
Another possibility of improving our modularity criteria could be: 

P_L (No unattainable effects): 

if ip —> [a]ip G £ , then S ,£ ,X ,X ^ y> — > [a]_L 
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This expresses that if we have explicitly stated an effect law for a in some 
context, then there should be no inexecutability law for the same action in 
the same context. It is straightforward to design an algorithm which checks 
whether this postulate is satisfied. We do not investigate this further here, 
but just observe that the slightly stronger version below leads to unintuitive 
consequences: 

P_L' (No unattainable effects - strong version): 

if S , £ |= p —> [a]tfj, then S ,£ ,X ,X \£ p —> [a]_L 

Indeed, for the above action theory we have 

£ 3 |= (-1 has Gun A loaded) —> [shoot]^ alive, 

but 

S 3 ,£ 3 ,X 3 ,1 3 |= (-i has Gun A loaded) —> [s/iooi]_L. 

This is certainly too strong. Our example also illustrates that it is sometimes 
natural to have 'redundancies' or 'overlaps' between £ and I. Indeed, as we 
have pointed out, inexecutability laws are a particular kind of effect laws, 
and the distinction here made is conventional. The decision of considering 
them as strictly different entities or not depends mainly on the context. At a 
representational level we prefer to keep them separated, while in Algorithm 1 
we have mixed them together in order to compute the consequences of an 
action. 

In what follows we address the problem of completing the set of executability 
laws of an action theory. 



7.2 Maximizing executability 

As we have seen, implicit static laws only show up when there are executability 
laws. So, a question that naturally raises is "which executability laws can be 
consistently added to a given action theory?" . 

A hypothesis usually made in the literature is that of maximization of ex- 
ecutabilities: in the absence of a proof that an action is inexecutable in a 
given context, assume its executability for that context. Such a hypothesis is 
captured by the following postulate that we investigate in this section: 

PX + (Maximal executability laws): 

if S,£ a ,X a ,l a \/^p^ [a]±, then S, X a h PDL p^ (a)T 
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Such a postulate expresses that if in context tp no inexecutability for a can 
be inferred, then the respective executability should follow in PDL from the 
executability and static laws. 

Postulate PX + generally holds in nonmonotonic frameworks, and can be en- 
forced in monotonic approaches such as ours by maximizing X a . We never- 
theless would like to point out that maximizing executability is not always 
intuitive. To witness, suppose we know that if we have the ignition key, the 
tank is full, . . ., and the battery tension is beyond 10 V, then the car (neces- 
sarily) will start. Suppose we also know that if the tension is below 8V, then 
the car will not start. What should we conclude in situations where we know 
that the tension is 9V? Maximizing executabilities makes us infer that it will 
start, but such reasoning is not what we want if we would like to be sure that 
all possible executions lead to the goal. 



8 Exploiting modularity 



In this section we present other properties related to consistency and modu- 
larity of action theories, emphasizing the main results that we obtain when 
Postulate PS* is satisfied. 

Theorem 38 If (S,£,X,X) with ~> satisfies PS*, then S,£,X ,1 \= _L if 
and only if S |= _L. 

This theorem says that if there are no implicit static laws, then consistency 
of an action theory can be checked by just checking consistency of S . 

Theorem 39 If(S,£,X,l) and~~> satisfy Postulate PS*, thenS,£,X,l \= 

if —> [a]ip if and only if S ,£ a ,X a \= ip —> [a]ip. 



PROOF. See Appendix D. 



This means that under PS* we have modularity inside £ , too: when deducing 
the effects of a we need not consider the action laws for other actions. Versions 
for executability and inexecutability can be stated as well: 

Theorem 40 If(S,£,X,T) and~~> satisfy Postulate PS*, thenS,£,X,l \= 
ip —> (a)T if and only if S ,X a \= ip — > ( a) T . 



PROOF. See Appendix E. 



Corollary 41 PX is a consequence of PS. 



PROOF. Straightforward. 



Theorem 42 If (S,£,X,X) and ~> satisfy Postulates PS* and PI*, t/ien 
S,£,X ,1 \=^ p> —> [a]_L i/ and ore/?/ if S ,T a |= (/? — > [a]_L. 



PROOF. 

(=>): If «S,£, A?,X |= </? — > [a]_L, then from PS* and Theorem 39 we have 
S,£ a ,l a \=^ p — > [ffl]-L. From this and PI* we get 5,X a |= (/? — > [a]_L. 

(^=): Suppose 5 ,£ ,X , X \£ p —> [a]_L. Then there is a ^-model M such that 

|=^ 5 A£ AX AX and ^ p -> M^- Then ; g iven a > we have M* 5 A£ a AX a M a , 
and then |= 5 A X a . Moreover, by definition, ^# is a PDL-model. Hence 



In Theorems 40 and 42, modularity guarantees moreover that no dependence 
is needed to derive, respectively, executabilities and inexecutabilities. 

Let £<*>■■■>*" = \Ji<i< n £ ai , X a ^°- = Ui<i<n^ a S and X^--"" = Ui<;<^. 
Under Postulate PS*, deduction of an effect of a sequence of actions a\\ . . . ; a n 
(prediction) needs neither the effect and inexecutability laws for actions other 
than a,i, . . . , a n , nor the executability laws of the domain: 

Theorem 43 If(S,£,X,l) and~~> satisfy Postulate PS* ; thenS,£,X,l \= 

p — > [ai; . . . ; a n ]ip if and only if S , 5°i.-,a» ) 2' 01 '-' a " |= </? — > [ai; . . . ; a„]^. 



PROOF. See Appendix F. 



The same result holds for testing inexecutability of a sequence of actions: 

Corollary 44 If{S,£,X,l) and~~> satisfy Postulate PS* ; thenS,£,X,l 
p -» [ai;...;a n ]_L »/ and onfy »/5,f 01 '-' a ",X° 1 '-' a " |= y? ->■ [a x ; . . . ; a n ]_L. 



PROOF. Straightforward, as a special case of Theorem 43. 



The next theorem shows that our notion of modularity is also fruitful in plan 
validation: 
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Theorem 45 Let (S ,£ ,X ,1) and ~> satisfy Postulate PS*. Then we have 
S,E,X,I \=^ (p -»■ (ai;...;a n )^ ifandonlyifS,£ ai '-' a ™,X ai '-' a ™,l ai '-' a ™ \=^ 
tp -> (ffli;...; Qn)^. 



PROOF. See Appendix G. 



And as a consequence, we also optimize testing executability of a plan: 

Corollary 46 Lei (S,£,X,X) and ^ satisfy Postulate PS*. TTien we /iave 
S,E,X,I ^ </? -»■ (ai;...;a n )T ifandordyifS,£ ai '"- an ,X ai >-> a »,I ai -- a » |=^ 

t/? -> (ai;...; a ra )T. 



PROOF. Straightforward, as a special case of Theorem 45. 



Theorems 43 and 45 together with Corollaries 44 and 46 suggest that we 
can simulate modularization by sub-domains [40]: If ({ffli, ... , a n }, Sptop') is a 
sub-domain for some *$top' C *$top, then ^S J £ ai '-' a " J X ai '- ,an ,T ai '- ,an ) with 
~» corresponds to the module for ({ffli, . . . , a n }, ^3rop') in Lifschitz and Ren's 
sense (see the next section). 



9 Related work 



Pirri and Reiter have investigated the metatheory of the Situation Calcu- 
lus [41]. In a spirit similar to ours, they use executability laws and effect laws. 
Contrarily to us, their executability laws are equivalences and are thus at the 
same time inexecutability laws. As they restrict themselves to domains with- 
out ramifications, there are no static laws, i.e., 5 = 0. For this setting they give 
a syntactical condition on effect laws guaranteeing that they do not interact 
with the executability laws in the sense that they do not entail implicit static 
laws. Basically, the condition says that when there are effect laws tpi —> [a]ip 
and if2 —> M -1 ^, then tpi and </?2 are inconsistent (which essentially amounts 
to having in their theories a kind of "implicit static law schema" of the form 
-i(<£i A<p 2 )). 

This then allows them to show that such theories are always consistent. More- 
over they thus simplify the entailment problem for this calculus, and show 
for several problems such as consistency or regression that only some of the 
modules of an action theory are necessary. 
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Amir [42] focuses on design and maintainability of action descriptions apply- 
ing many of the concepts of the object-oriented paradigm in the Situation 
Calculus. In that work, guidelines for a partitioned representation of a given 
theory are presented, with which the inference task can also be optimized, as 
it is restricted to the part of the theory that is really relevant to a given query. 
This is observed specially when different agents are involved: the design of an 
agent's theory can be done with no regard to others', and after the integration 
of multiple agents, queries about an agent's beliefs do not take into account 
the belief state of other agents. 

In the referred work, executabilities are as in [41] and the same condition on 
effect laws is assumed, which syntactically precludes the existence of implicit 
static laws. The frame problem is solved using Reiter's solution [32] and then 
is also restricted to domains without static laws. Ramifications are dealt with 
by compiling them away a la Reiter and Lin [43] based on the method given 
in [44], which takes into account only some restricted state constraints. 

In spite of using many of the object-oriented paradigm tools and techniques, 
no mention is made to the concepts of cohesion and coupling [45,46], which 
are closely related to modularity [12]. In the approach presented in [42], even 
if modules are highly cohesive, they are not necessarily lowly coupled, due to 
the dependence between objects in the reasoning phase. We do not investigate 
this further here, but conjecture that this could be done there by, during the 
reasoning process defined for that approach, avoiding passing to a module a 
formula of a type different from those it contains. 

The present work generalizes and extends Pirri and Reiter's result to the 
case where 5^0 and both these works where the syntactical restriction 
on effect laws is not made. This gives us more expressive power, as we can 
reason about inexecutabilities, and a better modularity in the sense that we 
do not combine formulas that are conceptually different (viz. executabilities 
and inexecutabilities). It also constitutes a better approach for domains with 
ramifications as we do not impose any restriction on the domain laws we can 
deal with. 

Zhang et al. [47] have also proposed an assessment of what a good action 
theory should look like. They develop the ideas in the framework of EPDL [6], 
an extended version of PDL which allows for propositions as modalities to 
represent a causal connection between literals. We do not present the details 
of that, but concentrate on the main meta-theoretical results. 

Zhang et al. propose a normal form for describing action theories, 8 and in- 



8 But not as expressive as one might think: For instance, in modeling the non- 
deterministic action of dropping a coin on a chessboard, we are not able to 
state [drop](black\J white). Instead, we should write something like [drop b i ack ]black, 
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vestigate three levels of consistency. Roughly speaking, a set of laws T is 
uniformly consistent if it is globally consistent (i.e., T W PDL -L); a formula <P 
is T -consistent if T W PDL ~ 1 ^, for T a uniformly consistent theory; T is ura- 
versally consistent if (in our terms) every logically possible world is accessible. 

Furthermore, two assumptions are made to preclude the existence of implicit 
qualifications. Satisfaction of such assumptions means the theory under con- 
sideration is safe, i.e., it is uniformly consistent. Such a normal form justifies 
the two assumptions made and on which their notion of good theories relies. 

Given this, they propose algorithms to test the different versions of consistency 
for a theory T that is in normal form. This test essentially amounts to checking 
whether T is safe, i.e., whether T |== («)T, for every action a. Success of 
this check should mean that the theory under analysis satisfies the consistency 
requirements. 

Although they are concerned with the same kind of problems that have been 
discussed in this work, they take an overall view of the subject, in the sense 
that all problems are dealt with together. This means that in their approach 
no special attention (in our sense) is given to the different components of the 
theory, and then every time something is wrong with it this is taken as a 
global problem inherent to the theory as a whole. Whereas such a "systemic" 
view of action theories is not necessarily a drawback (we have just seen the 
strong interaction that exists between the different sets of laws composing 
an action theory), being modular in our sense allows us to better identify the 
"problematic" laws and take care of them. Moreover, the advantage of allowing 
to find the set of laws which must be modified in order to achieve the desired 
consistency is made evident by the algorithms we have proposed (while their 
results only allow to decide whether a given theory satisfies some consistency 
requirement). 

Lang et al. [48] address consistency of action theories in a version of the causal 
laws approach [3], focusing on the computational aspects. 

To solve the frame problem, they suppose an abstract notion of completion. 
Given a theory T a containing logical information about a's direct effects as well 
as the indirect effects that may follow (expressed in the form of causal laws), 
the completion of T a , roughly speaking, is the original theory T a amended of 
some axioms stating the persistence of all non-affected (directly nor indirectly) 
literals. (Note that such a notion of completion is close to the underlying 
semantics of the dependence relation used throughout the present work, which 



[drop whlte ]white, [drop blacKwhlte ]black and [drop blacKwhlte ]white, where drop black is the 
action of dropping the coin on a black square (analogously for the others) and 
drop = drop black U drop whlte U drop black>whUe , with "U" the nondeterministic compo- 
sition of actions. 
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essentially amounts to the explanation closure assumption [26].) 

Their EXECUTABILITY problem is to check whether action a is executable in 
all possible initial states (Zhang et al.'s safety property). This amounts to 
testing whether every possible state w has a successor w' reachable by a such 
that w and w' both satisfy the completion of T a . For the Walking Turkey 
Scenario, the formalization of action tease with causal laws is given by: 



-T- tease 7T . ! 

. I => walking, i 

rr tease ' ' ' 



i alive => -^walking 



I 



where the hrst formula is a conditional effect law for tease, and the latter a 
causal law in McCain and Turner's sense. We will not dive in the technical 
details, and just note that the executability check will return "no" for this 
example as tease cannot be executed in a state satisfying -i alive. 

In the mentioned work, the authors are more concerned with the complexity 
analysis of the problem of doing such a consistency test and no algorithm for 
performing it is given, however. Despite the fact their motivation is the same 
as ours, again what is presented is a kind of "yes-no tool" which can help in 
doing a meta-theoretical analysis of a given action theory, and many of the 
comments concerning Zhang et al.'s approach could be repeated here. 

Another criticism that could be made about both these approaches concerns 
the assumption of full executability they rely on. We find it too strong to 
require all actions to be always executable (cf. Section 7), and to reject as bad 
an action theory admitting situations where some action cannot be executed 
at all. As an example, consider a very simple action theory (S ,£ ,X ,X), where 
S = {walking —> alive}, £ = {{tease]walking} , X = {{tease)T}, and T = 0, 
with a dependence relation given by ~» = {(tease, walking)}. Observe that, with 
our approach, it suffices to derive the implicit inexecutability law -i alive —> 
[tease]_L, change X, and the system will properly run in situations where -^alive 
is the case. 

On the other hand, if we consider the equivalent representation of such an 
action theory in the approach of Lang et al., after computing the completion 
of T tease , if we test its executability, we will get the answer "no" , the reason 
being that tease is not executable in the possible state where -i alive holds. Such 
an answer is correct, but note that with only this as guideline we have no idea 
about where a possible modification in the action theory should be carried out 
in order to achieve full executability for tease. The same observation holds for 
Zhang et al.'s proposal. 

Just to see how things can be even worse, let the same action theory as above, 
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but with X = {alive —> (tease)T}, obtained by its correction with the algo- 
rithms we proposed. Observe that the resulting theory satisfies all our postu- 
lates. It is not hard to see, however, that the representation of such an action 
theory in the above frameworks, when checked by their respective consistency 
tests, is still considered to have a problem. 

This problem arises because Lang et al.'s proposal do not allow for executabil- 
ity laws, thus one cannot make the distinction between X = {( tease) T}, 
X = {alive —> (tease)T} and X = 0. By their turn, Zhang et al.'s allows for 
specifying executabilities, however their consistency definitions do not distin- 
guish the cases alive —>■ (tease)T and (tease)T. 

A concept similar to that of implicit static laws was firstly addressed, as far as 
we are concerned, in the realm of regulation consistency with deontic logic [49]. 
Indeed, the notions of regulation consistency given in the mentioned work 
and that of modularity presented in [37] and refined here can be proved to 
be equivalent. The main difference between the mentioned work and the ap- 
proach in [37] relies on the fact that in [49] some syntactical restrictions on 
the formulas have to be made in order to make the algorithm to work. 

Lifschitz and Ren [40] propose an action description language derived from 
C+ [50] in which domain descriptions can also be decomposed in modules. 
Contrarily to our setting, in theirs a module is not a set of formulas for given 
action a, but rather a description of a subsystem of the theory, i.e., each 
module describes a set of interrelated fluents and actions. As an example, a 
module describing Lin's suitcase [2] should contain all causal laws in the sense 
of C-\- that are relevant to the scenario. Actions or fluents having nothing 
to do, neither directly nor indirectly, with the suitcase should be described in 
different modules. This feature makes such a decomposition somewhat domain- 
dependent, while here we have proposed a type-oriented modularization of the 
formulas, which does not depend on the domain. 

In the referred work, modules can be defined in order to specialize other mod- 
ules. This is done by making the new module to inherit and then specialize 
other modules' components. This is an important feature when elaborations 
are involved. In the suitcase example, adding a new action relevant to the 
suitcase description can be achieved by defining a new module inheriting all 
properties of the old one and containing the causal laws needed for the new 
action. Such ideas are interesting from the standpoint of software and knowl- 
edge engineer: reusability is an intrinsic property of the framework, and easy 
scalability promotes elaboration tolerance. 

Consistency of a given theory and how to prevent conflicts between modules 
(independent or inherited) however is not addressed. 

In this work we have illustrated by some examples what we can do in order 
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to make a theory intuitive. This involves theory modification. Action theory 
change has been addressed in the recent literature on revision and update [51- 
53]. In [54] we have investigated this issue and shown the importance that 
modularity has in such a task. 



10 Conclusion 



Our contribution is twofold: general, as we presented postulates that apply to 
all reasoning about actions formalisms; and specific, as we proposed algorithms 
for a dependence-based solution to the frame problem. 

We have defined here the concept of modularity of an action theory and 
pointed out some of the problems that arise if it is not satisfied. In particular 
we have argued that the non-dynamic part of action theories could influence 
but should not be influenced by the dynamic one. 9 

We have put forward some postulates, and in particular tried to demonstrate 
that when there are implicit static and inexecutability laws then one has 
slipped up in designing the action theory in question. As shown, a possible 
solution comes into its own with Algorithms 1 and 2, which can give us some 
guidelines in correcting an action theory if needed. By means of examples we 
have seen that there are several alternatives of correction, and choosing the 
right module to be modified as well as providing the intuitive information that 
must be supplied is up to the knowledge engineer. 

Given the difficulty of exhaustively enumerating all the preconditions under 
which a given action is executable (and also those under which such an action 
cannot be executed), it is reasonable to expect that there is always going to be 
some executability precondition tpi and some inexecutability precondition tp 2 
that together lead to a contradiction, forcing, thus, an implicit static law 
-i((/?i A ip-i). This is the reason we propose to state some information about 
both executabilities and inexecutabilities, and then run the algorithms in order 
to improve the description. 

It could be argued that unintuitive consequences in action theories are mainly 
due to badly written axioms and not to the lack of modularity. True enough, 
but what we have presented here is the case that making a domain description 
modular gives us a tool to detect at least some of such problems and correct it. 
(But note that we do not claim to correct badly written axioms automatically 



9 It might be objected that it is only by doing experiments that one learns the static 
laws that govern the universe. But note that this involves learning, whereas here - 
as always done in the reasoning about actions field - the static laws are known once 
forever, and do not evolve. 
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and once for all.) Besides this, having separate entities in the ontology and 
controlling their interaction help us to localize where the problems are, which 
can be crucial for real world applications. 

In this work we have illustrated by some examples what we can do in order 
to make a theory intuitive. This involves theory modification. In [31] we have 
presented a general method for changing a domain description given a formula 
we want to contract. Their we have defined a semantics for theory contraction 
and also presented its syntactical counterpart through contraction operators. 
Soundness and completeness of such operators with respect to the semantics 
have been established. In that work we have also shown that modularity is a 
sufficient condition for contraction to be successful. This gives further evidence 
that the notion of modularity is fruitful. 

Our postulates can be formulated in any reasoning about actions framework, 
but the algorithms require a decidable logic (in particular Algorithm 2). PDL is 
one candidate for that, as we have seen along the paper. For hrst-order-based 
frameworks the consistency checks of Algorithms 1 and 2 are undecidable. We 
can get rid of this by assuming that there is no function symbol in the language. 
In this way, the result of NewCons(.) is hnite and the algorithm terminates. 
Hence another candidate for our ideas would have been the Situation Calculus 
fragment with only propositional fluents. 

The present paper is also a step toward a solution to the problem of indirect 
dependences: indeed, if the implicit dependence shoot ^^ -^walking is not in ~>, 
then after running Algorithm 2 we get an indirect inexecutability (loaded A 
walking) —> [s/iooi]_L, i.e., shoot cannot be executed if loaded A walking holds. 
Such an unintuitive inexecutability is not in 1 and thus indicates the missing 
indirect dependence. 

The general case is nevertheless more complex, and it seems that such indirect 
dependences cannot be computed automatically in the case of indeterminate 
effects (cf. the example in [23]). We are currently investigating this issue. 

The first work on formalizing modularity in logical systems in general is due to 
Garson [55]. Modularity of theories in reasoning about actions was originally 
defined in [15]. Modularization of ontologies in description logics is addressed 
in [56]. A different viewpoint of the work we presented here can be found 
in [12], where modularity of action theories is assessed from a software en- 
gineering perspective. A modularity-based approach for narrative reasoning 
about actions is given in [57]. In [13] we show that our modularity notion can 
also be extended to ontologies in the description logic ACC. 

Our postulates do not take into account causality statements linking propo- 
sitions such as those defined in [2,3,58,39]. This could be a topic for further 
investigation. 
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A Proof of Theorem 22 



Let Si m p* be the output of Algorithm 1 on input (S ,£ a ,X a ,l a ) and^>. Then 
(S , £ a , X a ,X a ) with ~~> satisfies Postulate PS if and only if Si mp * = 0. 

We recall that |= is logical consequence in classical propositional logic, and 
PI(A) is the set of prime implicates of a set A of classical formulas. 

Before giving the proof of the theorems, we recall some properties of prime 
implicates [59,35] and of the function NewCons(.) [36] (see Section 4). Let 
ip G 3rnt, A Q #™( finite (identified with the conjunction of its formulas), and 
X be a clause. Then 

(1) |= pL ip ^API(<p) [35, Corollary 3.2]. 

(2) PI(A) U NewCons(ip, A) = PI(A A <p) (by definition of NewCons(.)). 

(3) |= pL (A Aip) ^ (A A NewCons(ip, A)) (from 1 and 2) 

(4) If PI(ip) \= CPL X) then there is \' £ PI{p) sucn that x' N-pi %■ ^^' P ro P°" 
sition 3.4]. 
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Let (S ,£ a ,X a , X a ) with ~> be an action theory for a, and let tp —>■ (a)T G X a , 
C a = £ a U l a , and C a C C a . We dehne: 

^c- = AM : Vi -» [<#* G <^ a } 

Moreover, let indep a = {-*£ : a 96 £}. 

Lemma 47 Lei indep' a C indep a . S U {^ c - a } U indep' a \= _L if and only if 
S U NewCons(ip£ a , S) U indep' a |= _L. 

PROOF. 

5 U {^ C -J u ^ep' a |= pL _L 
if and only if 

P7(5 U {^ c -»}) U indep a |= _L (by Property 1) 

if and only if 

PI(S) U NewCons(ipc a ,S) U indep' a |= _L (by Property 2) 

if and only if 

S U NewConsfyga, S) U indep a |= _L (by Property 1). 



Lemma 48 Let indep a C indep a . If S U NewCons(ip^ a ,S) U indep' a |= _L ; 
t/ien t/iere exists \ £ NewCons(ip^ a ,S) such that S U {x} U indep' a |= _L. 



PROOF. 

5 U NewCons(ipc a , S) U indep' a |= _L 

if and only if 

PI(S) U NewCons^ipga, S) U indep' a |= _L (by Property 1) 
if and only if 

PJ(S U {^ c -„}) U mdep' a |= pL _L (by Property 2) 
if and only if 

P/(5U{^})H CPL -AH = ^emrfep'J 
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if and only if 

PI(S U {^ c - }) h CPL \/{Zi ■ ~-U G indep'J 
if and only if there exists x £ -P/(5 U {^>c»}) such that 

X l= CPL V(^ : ~^i G mdep'J (by Property 4) 

if and only if 

{x} U indep' a |= pL J_ 

if and only if 

S U {x} U mdep' a |= pL _L 



Lemma 49 Lei indep a C indep a . If we have S Li {p, p^ a } Li indep' a ^_ _L and 
5 U NewConsfyfr, S) U indep a |= _L ; i/ien t/iere exists \ G NewCons{ip^ a , S) 
such that S U {x} U indep' a |= _L. 



PROOF. By Lemma 48 and classical logic. ■ 

Lemma 50 Let indep' a C indep a . If we have S U {tp , tp £ a } Llindep' a \/= _L and 
5 U NewConsfyfr, S) U indep' a |= _L ; t/ien t/iere exists \ G NewConsiyip^, S) 
such that both S U {(/?, <£> c -«} U indep a ^_ _L and 5 U {x} U indep a |= _L. 



PROOF. Trivially by Lemma 49. ■ 

Lemma 51 Let indep a C indep a . If x ^ NewCons{tp^ a ,S) is such that S U 
{</?, </? c - a }Umdep' a ^4 _L and 5u{x}U mdep' a |= _L ; t/ien 6ot/i 5u{(/?, (/? c - a }U 
{-i^i : £j G X anG ^ a 7^ ^i} ^p L -L an d $ U {x} U l -1 ^ : ^ £ X an d a */* 



PROOF. Let S U {p,p^ a } U indep a |4 _L and x £ NewCons^^, S) be 
such that 5 U {x} U indep a |= _L. 

If x = -L, the result is trivial. Otherwise, we have the following cases: 

• If atm(x) <j- atm(indep' a ) , then the premise is false (and the lemma trivially 
holds). 

• If atm(x) = atm(indep' a ) , the lemma holds. 

• Let atm(x) C atm(indep' a ) . Then, from 

S U {(/?, (/?£„} U indep' a Y z QPL -L (the hypothesis) 
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it follows 

S U {ip, ifca] U {-.£ : £i G x and a 96 £ { } ^. pL _L 

From 

5 U {x} U indep' a |= _L (hypothesis) 

and because 

5 U indep' a ^ cpL _L, 

it follows 

S U {x} U {-.£ : £ G x and a 96 £} h CPL -L. 



Lemma 52 i/x £ NewCons(tfj c ~ a , S) is such that both S U {<p, <Pca} U {—>£i : 
£i G x and a 7^ £;} ^_ pL _L and 5 U {x} U {^£ t : ^ G x «^ «?^ ^i} |=c PL -L, 



PROOF. From 

5 U {</?, Vc°} u {"^ : ^ G x and a 96 £,} ^ J_ 

we conclude 

5UH, : ^Gx and a 96^} ^ _L. 

From this and the hypothesis 

5 U {x} U {-4 : 4 G x and a 96 4} |= pL _L, 

it follows 

5 U {-i£ t : 4 G x and a 96 4} |= pL -i*. 

If 5 |== -ix, then 5 U {ip c \} \= CPL ~^Xi and because x G NewCons{ip^ a , S), we 
have x |=t- pl "'Xj a contradiction. Hence 5 U {x} ^- PL -L- 

Suppose now there is a literal £ G x such that -i£ ^ { _1 ^» : £% G x and a 7^ £i}. 
Then, the propositional valuation in which Xt<-true satishes 

5 U {x} U {-.£ : ^ G X and fl^ ^}, 

and then 

5 U {x} U {-.£ : 4 G x and a 76 4} ^. pL _L. 

Hence there cannot be such a literal, and then for all £i G Xi a ~h ^*- 

Now, from a 7^ 4 for all 4 G x ; we have |= Al -1 ^ : 4 G x and a 96 ^} <-> 
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->X- From this and the hypothesis 

S U {<p, ipca) U {-.£ : ii E X and a 76 £ € } ^ cpL _L 
it follows 5 U {ip, <p da , ~^x} ^ CPL - 1 - ■ 

Proof of Theorem 22 

We are about to prove that (S ,£ a ,X a ,T a ) with ^ satisfies Postulate PS if 
and only if Si mp * = 0. 

(=>): Suppose 5i mp * 7^ 0. Then at the first step of the algorithm there has 
been some ip —> (a)T E X a and some C a C C a such that for some \ £ 
NewCons(ifj (j a,S),S,£ a ,X a ,l a \=^ -i(pAp c -„A-ix) and 5 ^ cpL -n(</?A</? c - a A^x)- 
Hence (5, £ a , A' a ,T a ) does not satisfy Postulate PS. 

(-<=): Suppose that Si mp * = 0. Therefore for all tp' —> (a)T E X a and for all 
subsets C" C C, we have that 

for all x £ NewCons{ip^ a ,S), if 

^K^^^l, (A.l) 

then there exists £i E x such that a^> £i 

From (A.l) and Lemma 52, we get 

for all x £ NewGons{ip^ a ,S), if 
5 U {</?, p c -„} U {-.£ : 4 G X and a 76 4} ^. pL _L, 
then 5 U {x} U {-.£ : £ t E X and a 96 4} ^. pL _L 

From this and Lemma 51, it follows that 

for all x G NewCons(ip c ~ a , S), if 5 U {(/?', (/? c ~ a } U indep' a ^_ pL _L, 
then 5 U {x} U indep' a Vq PV _ -L 

This and Lemma 50 give us 

if 5 U {</, </? c - } U mdep' a [4_ pL _L, then 
5 U NewCons(tp^ a , S) U indep' a ^4 _L 

From this and Lemma 47, it follows that for all indep' a C indep a , for every 
p' -» («)T G A" 1 and all C a C C a , 

if 5 U {</?', </? c - a } U mdep' a ^. p| _ _L, then 5 U {ipc°-} u ^ e Pl ^ PL -L- 

(A.2) 
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Now, suppose S Yhpi f f° r some propositional p. We will build a model M 
such that j$ is a ^-model for (S , £ a , X a ,T a ) that does not satisfy p. 

Let ^# = (W, R a ) be such that W = valuations(S), and R a be such that for 
all w,w' G W, wR a w' if and only if 

• |= ; ^i for every i^ — > [a]^ G C a such that \= pi\ and 

• 1= -i£ for all £ such that a -/> £ and 1= -i£. 

We have that ./# is a ~>-model, by the definition of R a . By the dehnition of 
W, M is a model of S . We have that j& is a model of £ a and I a , too: for every 

>Pi —> [a\ipi G C a and every world w G W, if |= ^, then, by the dehnition of 
-Ra, 1= , "0i for all w' E W such that wR a w'. Moreover, M is also a model of 

w' 

X a : for every ^ ^ (a)T G A 1 " and every world w G W, if |= </?i, then 

£>) = fo -> [atyi e£ a :\{ pi}, 

and 

indep a (w) = {-*£ : a 7^^ and |= -*£} 

are such that 5 U {pi, pe a {w)\ U indep a (w) W PL -L, where 

¥>£»(«,) = Ai^* : ¥>» "^ M^i G ^ a (^)} 

From this and (A. 2), we have S U {ips^w)] U indep a (w) |A _L, where 

As W is maximal, there exists w' such that |= ; ips a { w ) A indep a (w). As i? a is 
maximal by dehnition, we have wR a w'. Hence there exists at least one w' such 
that wR a w', and \= (ffl)T. 



Hence, ^ is a model of (5, £ a , ,Y a , l a ) and^. Clearly \/= p, by the dehnition 
of W. Hence S,£ a ,X a ,l a ^ p. Therefore (S,£ a ,X a ,l a ) with ~> satishes 
Postulate PS. ■ 



B Proof of Theorem 31 



Let T? be the output of Algorithm 2 on input (S ,£ a ,X a ,T a ) and ~>. // 
(S ,£ a ,X a ,T a ) with ^ satisfies Postulate PS ; then it satisfies Postulate PI if 
and only ifl? mp = 0. 
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Let (S ,£ a ,X a ,T a ) be an action theory for a with a dependence relation ~>-. 
For every £ a C £ a we dehne: 

V£« = AM : Vi -> [<#« ^ £°} 

Moreover, let indep a = {-*£ : a-/> £}. 

Lemma 53 IfS,l a Yp DL (pga A indep'J — > [a]_L and 5 U {^ f -„} U indep' a |= 
_L ; i/ien i/iere w^G NewCons{ip £a ,S) such that S ,X a W, D . (y^A-ix) ~~ *■ M-L 
and a^ Hi for all f;G^ 

PROOF. Let S,T a ^ pDL (<^ a A mdej/J -» [a]_L. Then there is a PDL-model 
^ = (IF, i?„) such that |= S AT a and ^fc (ip £a A indep' a ) —> [a]_L. This means 
that there is a possible world w G IF such that |= (p £ ~ a A indep' a and p [ a ]-L. 
From |= (pg a A indep' a , it follows 

5 U {^} U indep' a ^ cpL L (B.l) 

From hypothesis 5 U {ip £a } U indep' a \= _L and Lemma 47, we get 

5 U NewCons(tp £a , S) U indep a |== _L 

and from this and Lemma 48 we have that there is x £ NewCons(tfj £a , S) such 
that 

S U {x} U mdej/ a |= pL J_ (B.2) 

From (B.l), (B.2) and classical logic, there is x £ NewCons(tfj £a , S) such that 
S U {ip £a } U mdep' a ^ cpL _L and 5 U {x} U indep' a ^= cp] _ _L 

From this and Lemma 51 it follows that there is x £ NewCons{ip £a ,S) such 
that 

5 U {<p, <p £a } U {-.£ : U G x and a 96 ^} ^. pL J_ 

and 

5 U {x} U {-4 : 4 G x and a 76 4} |= pL J_ 

This and Lemma 52 gives us that for all 4 G X) a "h ^%- 

Now, because ./# above is such that |= ip £a A indep' a , from this and S U {x} U 

indep' a |= _L, we have that |= y? £ -„ A ->x- Because p [ a ]-L, we therefore 
have 5, J a ^ pDL (^„ A -*) -> [a]_L ' ■ 
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Proof of Theorem 31 

We are about to prove that if (S , £ a , X a , X a ) with ~» satishes Postulate PS, 
then it satishes Postulate PI if and only ]$.T£ = 0. 

(=>): Straightforward, as every time S ,£ a ,X a ,X a \= tp —> [ffl]_L, we have 
S,l a |= (/? — > [a]_L, and then X^ p never changes. 

(<^=): Suppose that T? = 0. Therefore for all subsets £ a C £ a , we have that 

for all x G NewCons(ip £ - a , S), if 5,T a ^ pDL (p £ -„ A -.*) -> M-U / B 3 \ 

then there exists f ; Gx such that a ~~> 4 



From (B.3) and Lemma 53, it follows that for all £ a C £ a , 

if 5,T a ^ pDL (p £ - B A iradej/J -> [a]_L, 
then 5 U {^-J U indep' a ^ cpL i_. l ' j 



Suppose 5,T a ^ (/? — > [a]_L for some <p G 5ml. Then there exists a PDL- 
model jtft = ( W, R a ) such that |= S l\X a and ^ (/? — > [a]_L. This means that 
there is a possible world v G W such that 1= in and t£ [a|_L 

V V 

(We are going to build a ^-model of (S , £ a , A" , T a ), and hence conclude that 
S,£ a ,;r a ,X a ^ y?-*. [a]J_.) 

For given w G W, we dehne: 

X» = { ¥ , i -[ fl ]_Lel- :£>,} 

Because (S,£ a ,X a ,T a ) with ~> satishes Postulate PS, we can extend ^# to 
a big model ^#' = ( H/, i?' n ) such that VF = valuations(S), and i?' n is dehned 
such that for all w,w' G W', wR' a w' if and only if 

• 1= -i£ for all £ such that a "U l and 1= -i£; 

w' w 

• |= ; ^j for every tpi —> [a\ipi G £ a such that |= tpi, and 

• X°(«;) = 0. 

By definition, ^#' is a ~>-model. We also have |= S , by the dehnition of W 1 . 
j^' is a model of £ a , too: for every tpi —> [a\ipi G £ a and every w G W , if 
1= ipi, then 1= -0J for all w 1 E W such that wR'w'. Clearly ^#' is also a 

w w' 

model of l a : for every ip^ — > [a]_L G X a and every w G W', if |= ipi, then 
l a (w) ^ and R' a (w) = $• ^' i s a model oiX a , too: for every ^ — > (a)T G A" 1 



and every w G W 1 , if 1= tpi, then 

w 

£ a (w) = { Vi -> [a]^ G 5 a : |=* ^} 

and 

indep a (w) = {-*£ : a ^ £ and |= -i£} 

are such that 5,I a ^ {<Ps°(w) A indep a (w)) —> [a]_L, where 

¥>£»(u;) = Ai^i : V* -* [*#* G ^M} 

The justification is that 5,X a |= { ( fs a {w) A indep a (w)) —> [a]_L would imply 
5, 5 a , A" a , T a |= ((p£a( w )Aindep a (w)) —> [a]_L, and as long as <^ — > (a)T G A" a , 
5,5 a , ^ a ,T a h^ -^feA^H A indep a (w)). As by hypothesis (5, £ a , X a ,l a ) 
satisfies PS, 5 |= _i ((^i A fe^w) A indep a (w)), and then io ^ H^. 

Hence, from 5,X a |^= (tps a (w) A indep a (w)) —> [a]_L and (B.4), it follows that 
5 U {^£>(™)} U indepjw) ^_ pL _L, where 

^£>(™) = f\{ipi ■ <Pi -» [<#i e «^ a (^)} 

As W' is maximal, there exists «/ such that \= : ipe a {w) A indep a (w). As i?' a 
is maximal by definition, we have wR' a w'. Hence there exists at least one w' 
such that wR'w', and then 1= (a)T. 

Therefore, J{' is a model of (S,£ a ,X a ,X a ) and ~». 

Looking at v G H^, we must have 5,T a |^= {<fe a (v) A indep a (v)) —> [a]_L, 
because otherwise R a (v) = 0, against the hypothesis that p [a]_L. Hence, 
from (B.4) it follows that S U {^£»(^)} U indep a (v) ^_ _L, and then there 

exists at least one v' such that vR' a v', and then |= ; (ffl)T. From this it fol- 
lows that S,£ a ,X a ,l a ^ tp -» [a]_L Therefore (,s"£ ,;t ,J ) and ~> satisfy 
Postulate PI. ■ 



C Proof of Theorem 37 



Let (S ,£ ,X ,1) with ^^ satisfy PS*. (S ,£ ,X ,T) with ^ satisfies PI* if and 
only if {S ,£ a , X a ,l a ) and ~> satisfy PI /or a// a G 2lct. 

(^>): Suppose that 5,5 a , A' a ,T a |= (/? — > [a]_L By monotonicity, 5, 5, #,2" |= 
(/? — > [ffl]-L, too. Now suppose that 5,X a |^= </? — > [a]_L. Then there exists a 

possible worlds model .^f = (W, R a ) such that \= S Al° and there is a pos- 
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sible world v £ W such that 1= tp and t£ [al_L Let ^#' = ( W . R f ) be such 

V V 

that H^ = W, and #' a , = 0, for all a 1 ^ a, and R' a = R a . Then |=^' 5 A J, and 
then 5,2" W, D . p —> [a]_L. Hence (S ,£ ,X ,T) with ~> does not satisfy PI*. 

(^=): Suppose (S ,£ ,X ,T) and ~> do not satisfy Postulate PI*. Then there 
exists p G Jmi such that S,£,X,T \=^ p —> [a]_L and 5,1 |^= </? — > [a]_L. 

Claim: 5,5 a ,;t a ,2" a ^ </? -»■ [a]_L 

(Proof of the claim): Suppose S,£ a , X a , X a \/= p —>■ [a]_L. Then there exists a 
^-model ^ = ( W, R a ) such that |=^ 5 A £ a A X a A J a and ^ <p -»■ [a]_L 
This means that there is a possible world v G IV such that 1= p and tfc [ffll-L, 

V V 

i.e., there is v' G VF such that R a (v) = v'. 

(We extend ^# to all other actions (S,£, X, X) speaks of and obtain a ~»- 
model of (5, £ , X ,T).) 

Given w G W, for each a; G 2lct we dehne: 

Let J{' = (W , R') be such that W' = Rf, and R' = R a U \J a ^ a R a ,, where for 
each a! ^ a and every w,w' E W 1 , wR a >w' if and only if 

• 1= -i£ for all t such that a! ~U d and 1= -i£; 

• \= t ipi for every </?i — > [a!]ipi G 5 a such that |= pf, and 

• l a \w) = 0. 

By dehnition, ^#' is a model of the dependence relation ~>. Because, by hy- 
pothesis, (5, £, X ,1) with ~> satishes PS*, there is no implicit static law, i.e., 
for every a; G 2lct and every k; G W', if l ai (w) ^ 0, then ^^(k;) = 0. Then, 
as W = valuations(S), M' is a model of 5. We have that ^#' is a model 
of £, too: it is a model of £ a , and given a' ^ a, for every y>j — > [a']ipi G £ 

and every w G H^, if \= Pi, then 1= ^ for all w' G W 7 such that wR a rw'. 

WW 1 

Clearly M 1 is also a model of I: it is a model of l a , and given a' ^ a, for 
every pi —> [a']_L G I and every w G W', if |= pi, then X a (w) ^ and 
R a '{w) = 0. ^#' is a model of X, too: besides being a model of ,Y a , for every 
a' ^ a and all worlds w £ W 1 such that ,Y a (w) ^ there is a world acces- 
sible by R a i, because R a i{w) = in this case would preclude X a (w) ^ 0, 
and otherwise w ^ W , which is impossible as long as PS* is satisfied. Thus 

Ml 

|= 5 A £ A A" A I, but if this is the case, 5, £, X ,X \£ p —>■ [a]_L, hence we 
must have 5, £ a , X a , X a \= p —>■ [a]_L. (End of the proof of the claim.) 
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From S,X ^4 (p — > [a]_L it follows S,I a ^= (/? — > [a]-L. Putting all the 
results together, we have that (S ,£ a ,X a ,X a ) with ~> does not satisfy Postu- 
late PI. ■ 



D Proof of Theorem 39 



If (S ,£ ,X ,X) and ^ satisfy Postulate PS* , thenS,£,X,X \= ip —> [a]ip if 
and only if S,£ a ,X a \= <p —> [a]ib. 

(=>): Let (S ,£ ,X ,X) and ~» satisfy Postulate PS*, and also suppose that 
S,£ a ,X a |^= ip —> [a]ip. Then there exists a ~> -mo del ^# = (IT, i? ), such that 

|= S A £ a AX a and p y? — > [a]?/\ This means that there is a possible world 
v G IT such that |= </? and ^£ [a]^>, i.e., there is i/ G IT such that R a (v) = v' 

and tfc ib. 

v' 

(We will extend M to obtain a ^-model of (S ,£ ,X ,X) and thus show that 
S,£,X,l\/^<p^[a]ip.) 

Given w G W, for each a; G 2lct we dehne: 

l» = { w -»[« i ]lel»' = hf Pi> 

X«(w) = { Vj - (a 8 )T G X" :|=%/| 

Let ^' = (IT ', #') be such that W" = IT, and R' = R a U [J a ,^ a R a >, where for 
each a! ^ a and every w,w' E W 1 , wR a >w' if and only if 

• 1= -i£ for all t such that a' ~U t and 1= -i£: 

w' w 

• \= t ipi for every tpi —> [a']ipi G £ a such that |= (/?,; and 

• l a \w) = 0. 

By definition, ^#' is a model of the dependence relation ~~>. Because, by hy- 
pothesis, (S ,£ ,X ,1) satisfies PS*, there is no implicit static law, i.e., for 
every a { G 2lct and every w G T', if l ai (w) ^ 0, then X ai (w) = 0. Then, as 
W = valuations(S), M' is a model of 5. We have that ^#' is a model of £ , 
too: it is a model of £ a , and given a' 7^ a, for every y>j — > [a']ipi G 5 and every 

w G H^, if 1= <fii, then 1= , ^ for all w' G T' such that wR a /w'. Clearly 
j&' is also a model of X: besides being a model of X a , given a' ^ a, for every 
(/?i — > [a']± G J and every w G T', if |= </?;, then X a ' (w) ^ and R a >(w) = 0. 
./#' is a model of T, too: it is a model of X a , and for every a' ^ a and all 
worlds w E W 1 such that T a (it;) ^ there is a world accessible by R a >, because 
R a '{ w ) = in this case would preclude X a (w) ^ 0, and otherwise w ^ W , 
which is impossible as long as PS* is satisfied. Thus |= S A £ A X A X. 
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Because there are v.v' G W such that 1= ip, vR a v' and y= ib, we have 

v v' 

S,£,X,X\^ ip — > [a]ip. 

(<^=): Suppose 5, £, ,Y,I |^ (/? — > [ffl]^. Then there is a ^-model ^# such that 
H^ 5A<f AA'AJ and ^ <p -»■ [a]^. Then, given a, we have |=^ 5A£ a AA" a AX a , 
and then \^ S A£ a Al a . Hence S,£ a ,l a ^ p -»■ [a]^. ■ 



E Proof of Theorem 40 

If (S,£ ,X ,X) and ^ satisfy Postulate PS* , then S ,£ ,X ,X \= ip —> (a)T if 
and only if'S,X a \= ip — > (a)T. 

(=>): Let (S ,£ ,X ,X) and ^> satisfy Postulate PS*, and suppose 5,,Y a ^ 
</? — > (a)T. Then there exists a PDL-model ^# = ( W, R a ), such that |= S AX a 
and ^ (/? — > (a)T. This means that there is a possible world v G VFsuch that 
1= ip and bt (ffl)T. 

(We extend ^ to build a ^-model of (S,£,X,X) and then conclude that 
Given w £ W, for each a; G 2lct we dehne: 

Let JK' = (W 1 , R') be such that W = W, and R' = R a U \J a ,^ a R a ,, where for 
each a! ^ a and every w,w' E W 1 , wR a >w' if and only if 

• 1= -i£ for all t such that a' ~U I and 1= -i£; 

• |= ; ^ for every ipi —> [a']ipi G £ a such that |= ^5 and 

• X a \w) = 0. 

By definition, jtft' is a model of the dependence relation ~>. Because, by hy- 
pothesis, (S,£,X,X) satisfies PS*, there is no implicit static law, i.e., for 
every a, G 2lct and every w G H 7 ', if X ai (w) ^ 0, then l ai (w) = 0. Then, 
as W = valuations(S), M' is a model of 5. We have that ^#' is a model 
of £ , too: it is a model of £ a , and given a' 7^ a, for every (/^ — > [a']ipi G £ 

and every w G W', if \= ipi, then 1= ipi for all w' <E W 1 such that wR a >w'. 

w _ w' 

Clearly ^' is also a model of X: it is a model of T a , and given a' ^ a, for 
every <pi —> [a']_L G I and every w; G W 1 , if |= </?i, then X a (w) ^ and 
R a '{ w ) = 0- ^' is a model of ^, too: besides being a model of X a , for every 
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a' ^ a and all worlds w G W such that X a (w) ^ there is a world acces- 
sible by R a i, because R a >(w) = in this case would preclude X a (w) ^ 0, 
and otherwise w ^ W 1 , which is impossible as long as PS* is satisfied. Hence 
1= 5 A£ AAf Al. Because there is v G W such that 1= <p and tt (ffl)T, 
we have S ,£ ,X ,1 \£ p> — > ( a) T . 

(<^=): Suppose 5, f , A",X ^= y> — > (a)T. Then there is a^-model M such that 
H^ 5A<f A* A J and ^ <p -»■ (a)T. Then, given a, we have ^ SA£ a AX a M a , 
and then |= 5 A X a . Moreover, by dehnition, M is a PDL-model. Hence 
5,*<% DL¥ >-<a>T. ■ 



F Proof of Theorem 43 



If(S, £ , X,I) and^ satisfy Postulate PS* ; thenS , £, A", I |= (/? — > [% . . . ; a ra ]^ 
if and only if S,£ au - ,an ,I ai '-' an \= p — > [a x ; . . . ; a n ]^. 

Lemma 54 If S,£,X,I \= p —> [%; . . . ; a n ]?/>, t/ien t/iere zs y/ G Jmt suc/i 
i/iai 5, £ , A", I |= </? — > [ffli; . . . ; a n _i]<p' and S, £ , X,I \= p' —>■ [a n ]i(j. 



PROOF. Let S , £ , X ,1 \= p> — > \a\\ . . . ; a re ]?/>. In the case we have S ,£ ,X ,1 \= 
ip —> [ffli; . . . ; a n ]_L, the result immediately follows. Then, given a model ^# = 
( W, R) of (S , 5, X.I) such that 1= w for some w G W, if 1= (ffli; . . . ; a n )T, 

w w 

there must be at least one w' n _ 1 such that |= ; [aj^- Take all such w' n _ l and 

n — 1 

let ip' be 

V ™n-l 



Then we have both 5, £ , X ,1 \= p> —> [a\, . . . ; a n _i]p>', and S,£,X,I \= 

<p' -> [a ra ]^. I 



Proof of Theorem 43 

(=>): The proof is by induction on the number of action operators. 

Base: n = 1. As (S ,£ ,X ,1) satisfies Postulate PS*, the result follows from 
Theorem 39. 

Induction hypothesis: for any k < n, if S, £, X ,1 \= p —> [a,i; . . . ; a^tfj, then 

S ^a lt ...,a^ Iai ,...,a k ]_ ^ _^ [a^ . . . ■ a k ]lp . 
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Step: let S,£,X,X \= p —> [ai; . . . ; a n ]tfj . By Lemma 54, there is a classical 
formula p' such that S ,£ ,X ,X \= p —> [a\\ . . . ; a n _i]p' and S , £ , X ,X |= 
ip' —> [a n ]ifj. From the induction hypothesis, we have S , £ a i>---> a n-i } Z ai '•••> a ™- 1 |= 
9? -» [a 1 ;...;a n _ 1 ]^ / and5,5 a ",T a " \=^ p' -» [a ra ]?/;. Thus 5, 5 ai '-' a ",T ai '-' a "^ 
<£ -> [ai; . . .; a^. 

(^=): Suppose 5, £, ,F,I ^ </? — > [ai; . . . ; a n ]ip. Then there is a ^-model ^ 

such that |= iSA^A^ l\X and p (/? — > [a^ . . . ; a n ]?/\ Then, given a l5 . . . , a ra , 

we have |=^ 5 A5 B1 °" a A"* 1 --"" AX 01 '"-"", and then |=^ 5 A£ ai --°" AJ ai, - ,a ". 

Hence 5,£ olv "' a ",X° 1 '-' a " ^= (/? — > [ai; . . . ; a n ]?/\ ■ 



G Proof of Theorem 45 



Lei (S ,£ ,X ,X) and ~~> satisfy Postulate PS*. TTien we /iawe S,£,X,X \= 

p — > (ai; . . . ; a n )?/> i/ared on/y ifS,S ai '-' an , x ai '-' an ,X ai '-' an \= p — > (ai; . . . ; a n )?/>. 

Lemma 55 Let (S,£ ,X ,X) and ~> satisfy Postulate PS*. If'S,£,X,X \= 

<p -»■ (a)^, thenS,£ a , X a ,X a |= p ^ (a)ip. 



PROOF. Let (S,£,X,X) satisfy Postulate PS* and suppose 5, £ a , ^ a ,T a ^ 
(/? — > (a)?/\ Then there exists a ^-model ^# = (W, i?„), such that both 
|= 5 A £ a A ,F a A T a and p (/? — > (a)?/\ This means that there is a pos- 
sible world v G IF such that 1= <z> and t£ (a)?/;. 

V V 

(We extend ^# to build a model of (S ,£ ,X ,X) and then conclude that 
<S,£,*,X^^(a)^.) 

Given it; G W, for each a; G 2lct we define: 

X^(w) = {p j ^(a i )TeX^ : ^ ¥>;} 

Let ^#' = (W,R') be such that W = W, and R' = R a \J [} a ,^ a R a , (we 
extend ^# to all other actions (S ,£ ,X ,X) speaks of), where for each a' ^ a 
and every w,w' G IF 7 , wR a >w' if and only if 

• 1= -i£ for all t such that a' ~U I and 1= -i£; 

• |= ; ^i for every y>j — > [a']^ G £ a such that |= pf, and 

• X^(w) = 0. 

By definition, ^#' is a model of the dependence relation ~>. Because, by hy- 
pothesis, (S ,£ ,X ,X) satisfies PS*, there is no implicit static law, i.e., for 
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every a; G 2tct and every w G W , if X ai (w) ^ 0, then l ai (w) = 0. Then, 
as W' = valuations(S), jtft' is a model of S. We have that ^#' is a model 
of £ , too: it is a model of £ a , and given a' ^ a, for every ifi —> [a!]ipi G £ 

Ml SSI 

and every w G W 1 , if 1= ^ then 1= ipi for all w' E W such that wR a iw'. 

w w' 

Clearly ^' is also a model of I: it is a model of I a , and given a' ^ a, for 
every ipi —> [a']_L G I and every w G tF, if |= <^j, then X a (w) ^ and 
R a '{ w ) = 0- ^' is a model of A", too: besides being a model of X a , for every 
a' ^ a and all worlds w G W such that ,F a (w) ^ there is a world acces- 
sible by R a i, because R a >(w) = in this case would preclude X a (w) ^ 0, 
and otherwise w ^ W 1 , which is impossible as long as PS* is satished. Hence 
1= S AS A X Ai. Because there is v G W 1 such that 1= in and tfc (a)ip, 

V V 

we have S, £, X ,X \£ if —>■ {a)ip. ■ 

Lemma 56 If S, £ , X ,X \= if —> (ai; . . . ; a n )ip, then there is if' G Jml such 
that S ,£ ,X ,T \= ip —> (ai; ...; a n _i) ip' and S,£,X, I \= if' —>■ {a n )ip. 



PROOF. The proof is by induction on the number of action operators. 

Base: n = 2. Suppose S ,£ ,X ,1 \= if —> (a\; aa)ip. Then S , £ ,X ,T \= if —> 
(o>i)(oa)tp- For every model M = (W, R) of (S ,£ ,X ,T) and for every w G W 
such that 1= if, there is w' G IF such that wR ai w' and |= (a 2 )ip. Let if' be 

w w' 

f\{£ : £ G w'} and the result follows. 

Induction hypothesis: for any k < n, if S,£,X,T \= if —> (ai; . . . ; a^)ip, 
then there is if' G ^xnX such that S,£,X,T \= if —> (a x ; . . . ; a^_i)if' and 
S,£,X,1 \=^<f' -> (afc)^- 

Step: let 5, 5, A", J |= </? — > (a\; . . . ; a n )ip. Then we have that S ,£ ,X ,X |= 
(/? — > (ai; . . . ; a ra _i)T. By the induction hypothesis, there is if' G Jml such 
that 5,^,^,1 |= if —> (ai; . . . ; a n _ 2 )if' and 5, £ , A", J |= <// — > (a n _ 1 )T. 
Because 5,£,A",I |= if —>■ (a^, . . .; a n )ip, given a model M = (W, R) of 

(S ,£ ,X ,T) such that |= </? for some w G tF, there must be iu'_ 2 G JF such 

that |= , (a n _i) (a n )tfj . Then we can safely take if' as A{^ : ^ £ ^-2}- 

n — 2 

Now, S,S,X,I |= (/?' — > {a n _i){a n )ip. By the base step, there is if" G 5ttv( 
such that S,£,X,1 \= if' —> (a n _i)ip" and S,£,X,X \= if" —> {a n )ip. 
Putting all the results together, we get S,£,X,T \= ip —> (%; . . . ; a n _i)ip" 
and S ,£ ,X ,T \= if" —> {a n )ip, for some if" G JmL ■ 



Proof of Theorem 45 

(=^): The proof is by induction on the number of action operators. 
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Base: n = 1. As (S ,£ ,X ,T) satisfies Postulate PS*, the result follows from 
Lemma 55. 

Induction hypothesis: for any k < n, if S, £ , X,X \= ip —> (a\; . . . ; a,k)i/), then 
S ,£<*•■■■><*, X ai -"> Qk ,I ai -"> a * |^ if -» (a 1 ;...;a k )ip. " 

Step: let 5, £ , A", I |= (/? — > (a^ . . . ; a n )?/>. By Lemma 56, there is if' G $m[ 
such that S, £, X ,X \= if —> (%; . . . ; a n _i)ip' and S, £, X,T \= if' —>■ {a n )ip. 
By the induction hypothesis, we have S, £ a u-,°-n.-i^ ^a u ...,a n _ 1 ^ j«i,-a-i |_ 
if — > (ax; . . . ; On-ijip' and also 5, £"", X an ,X an \= if' — > (a n )ip. Then, this 
gives us «S,£ 01 '- ,a ", A" 11 ""J" 1 '-' 11 " |= ip —^ (a^, . . .; a n )i(j. 

(<^=): Suppose 5, £, ,Y,I ^ </? — > (ai; . . . ; a^)^. Then there is a ^-model ^ 
such that |= 5 l\E l\X I\X and ^ (/? — > (%;... ; a„ )■?/>. Then, given a l5 . . . , a n , 
\^ 5Af ai -- a "AA" ,1> - >a "AX 01, -' a ", andhence5,£ ai '-' a ",A' ai '-' a ",T ai '-' a " ^ 
yj -» (ai;...;a„)^. ■ 
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